I Lost $4,000 on a Google Bill Because of My AI Agent Key API

By Iaroslav Belkin, founder of Belkin Marketing

This month I got an unusually large bill from Google.

What happened was embarrassing and, in retrospect, almost comically preventable. I had a Google API key that was public by design, the kind that lives openly in frontend code. Totally normal. Architecturally expected. What was not expected: someone on my team had also quietly enabled Gemini API access on the same project. Paid API. Turns out there are people running continuous automated scanners looking for exactly this combination. Well, they found it before I did. The budget alert from Google arrived hours after the damage had already compounded into something significant.

Google Support compensated about 75% after some back and forth. The rest had to come out of my pocket. And the infuriating part is I am far from alone. Search LinkedIn right now and you will find dozens of people with the same story, same timeline, same Google alert that arrived too late.

The Agent Key Problem Nobody Is Naming

Here is the thing I actually want to talk about, because the Google bill is just the entry point.

Every time you ask an AI agent to do something real in the world, configure Cloudflare, SSH into a server, push to a repo, hit an external API, you hand it a credential. That credential goes somewhere. Chat history. ENV file. Project context. And from every one of those places it can walk out the door.

I used to paste API keys directly into chat windows. I know exactly how that sounds. The honest version: it felt completely natural because the workflow made it natural. Agent needs a key. I have the key. Done. I did not think of it as a security decision because it did not feel like one.

The problem is not only what you do with your own keys. Sometimes the threat arrives through a package you have been trusting for years.

On March 31, 2026, attackers took over the npm account of Axios lead maintainer jasonsaayman through a social engineering campaign and published two backdoored versions (1.14.1 and 0.30.4) containing a hidden dependency called plain-crypto-js. Axios has over 100 million weekly downloads. It is in virtually every JavaScript project that exists. For two hours and 54 minutes, running npm install axios meant receiving a cross-platform Remote Access Trojan that silently pulled credentials off the machine, established a backdoor, and then deleted itself. Wiz researchers watched the attackers validate stolen credentials within hours using TruffleHog, then fan out across AWS services: IAM, EC2, Lambda, S3, Secrets Manager. Two hours and fifty-four minutes. That is it.

That npm install could have been a developer doing routine maintenance. Could equally have been an agent running a dependency update as part of a larger task, at 2am, with nobody watching. The package had been trusted for years. Your agent had no reason to question it. Neither did you.

For me personally the blast radius would have been ugly: SSH keys to client infrastructure, Cloudflare, GitHub, GitLab, platform credentials across a dozen services. One key out and the question stops being whether damage happens. It becomes how fast it spreads before anyone notices.

So What Do You Actually Do

No checklist makes this problem disappear. I want to say that first because every article about security implies that following the steps fixes it, and it does not.

That said, some things genuinely reduce the risk.

• IP restrictions are the most underused control available. Most serious API providers, Cloudflare, AWS, GCP, Google, let you tie a key to specific IP addresses or trusted subnets. A key that only works from your production server’s IP is not worthless if it leaks. A key that works from any IP on earth is a loaded weapon someone else can pick up. It takes fifteen minutes to configure. Most people never do it. I did not, until I paid for not doing it.
• Spending caps: set them low. Not at your actual budget ceiling. The Google alert that arrived after my bill had already compounded is not an alert, it is a receipt. I now set thresholds at roughly 20% of expected spend. Annoying to adjust occasionally. Much less annoying than a four-figure surprise.
• Key expiry is the one I am genuinely worst at. (Every time I grant a key for a one-off task I tell myself I will revoke it afterward. Three months later it is still live and I have completely forgotten it exists. I know this about myself and I still do it.) The discipline is simple: keys for one task die after that task. Standing access accumulates invisibly and gets exploited precisely because nobody remembers it is there.

The deeper architectural fix, and the one that actually addresses the agent-specific risk, is building a setup where the agent never holds the key at all. It requests a credential, something trusted injects it directly into the outgoing call, and the value never appears anywhere: not in chat history, not in logs, not in ENV files. Hardware-backed storage like Apple’s Secure Enclave takes this further still: encrypted at the chip level, unreachable even if the machine is compromised at the software layer. The attack surface does not go to zero but it gets close.

The axios attack was live for under three hours. The agent that ran npm install during that window was doing nothing wrong. What decided the outcome was what was sitting behind the keys it had access to.

Iaroslav Belkin is the founder of Belkin Marketing, a strategic intelligence firm executing mission-critical engagements for AI, deep tech and frontier technology companies. Strategic partnerships, international expansion, executive positioning, VVIP events and access to the World Economic Forum in Davos.

See more breaking stories here.