Australian AI consultant Jesse Davis had set a modest monthly budget of just $7 (around 50 RMB) for his Google Cloud account. However, he was shocked to find a staggering bill of $18,392 (approximately 132,400 RMB) waiting for him, with costs having surged within a few hours overnight. Despite having implemented several security measures, an attacker managed to exploit a public link to a cloud-hosted service that Davis had published months prior, flooding it with over 60,000 requests. Google's official agent program read the API key, which was stored in plaintext within the container, and authorized each request, causing the costs to skyrocket. Google Cloud does offer nine security protection features, but they are all disabled by default. To make matters worse, the account was automatically upgraded without any notification, significantly increasing the spending limit. In the end, Google agreed to waive the entire debt, and the bank refunded the deducted amount.
