A Google Cloud developer woke up to a $17,000 bill from API calls he never made, and the part that actually matters is what it reveals about how cloud platforms define their own security standards - Silicon Canals

Security and governance are presented as prerequisites for AI strategy, with emphasis on data strategy and security strategy working together. “Shadow AI” is identified as a risk when employees use consumer tools without organizational oversight. Adversary coordination is described as accelerating attacks, reducing the time between initial access and hand-off to follow-on attackers to about 22 seconds. A proposed response is shifting from human-in-the-loop to AI-led defense, with humans overseeing rather than operating. Meanwhile, incidents show compromised API keys can continue working after deletion for up to 23 minutes, and unauthorized API calls can trigger large bills despite spending caps. Reimbursements may occur without changing underlying policy.

"“There's no such thing as an AI strategy without a data strategy and a security strategy. They need to go hand in hand.” Francis de Souza, Google Cloud's COO, shared at a recent Los Angeles event that companies need to demand security, governance, and auditability from their platforms from the start, and warned specifically about “shadow AI” - employees reaching for consumer tools without organisational oversight."

"Google's own Mandiant M-Trends 2026 report, presented at RSAC, found that adversary coordination has driven the time between initial access and hand-off to a follow-on attacker down to 22 seconds. The implication: human-led defence is structurally too slow. Google Cloud's proposed answer, articulated at Cloud Next 2026, is a shift from human-in-the-loop to AI-led defence, with humans overseeing rather than operating in the loop."

"While that case was being made, The Register was documenting a different story about the same platform. Prentus CEO Rod Danan watched his Google Cloud bill hit $10,138 in about 30 minutes after attackers used a compromised API key. Sydney-based developer Isuru Fonseka woke up to charges of roughly AUD $17,000 despite believing he had a $250 spending cap in place. Google later reimbursed both after the reporting appeared but said it would not change the underlying policy."

Read at Silicon Canals