One of the developers argued on Reddit that cloud providers should implement stronger safeguards
Uh, stronger safeguards like LIKE ENABLING TWO FACTOR AUTHENTICATION YOU FUCKING IDIOTS.
this post was submitted on 03 Mar 2026
63 points (95.7% liked)
Technology
82188 readers
3909 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
The developers said they did not believe they made any "obvious" operational mistake. After discovering the compromised key, they attempted to secure their system by deleting exposed keys, disabling Google Gemini API access, and enabling two-factor authentication across their accounts.
I'm no "cloud developer", but there seem to be a few obvious operational mistakes described just in that paragraph alone....
After discovering the robbery, the bank installed doors and locks.
Fuck Reddit and Fuck Spez.
'Turned $180 billion into $82,000 in two days'
Wait, I thought this story was about Google AI, not OpenAI.
It all the same garbage.
Google is a bad company with bad policies, but I'd love to have them explain what caused the compromise. They dispute that it was uploaded publicly to GitHub, but don't seem to provide any information as to what happened. They also didn't have 2fa on, which is strange to hear because AWS (they're using Google) required 2fa on all accounts at least a year ago, regardless of permissions if memory serves. Really sorry to hear this happened to them, and the fact you can't set a hard cap on spend makes Google the party ultimately responsible here, but I'd appreciate having more information on the actual cause.
Google also changed the rules on API key security after years of precedent.
https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules
I'm sure they have a reason for everything they do, but rarely are they good reasons.
~~Don't be evil~~
Good