Google billed solo developer Charles Jones more than $11,000 over 48 hours after a compromised service account key ran up Gemini image-generation charges, flagged the hijack itself, then refused to refund him, according to The Register. Jones, whose business is programmatic SEO and insurance sites, says the account never generated AI images, and Google reinstated it after he revoked the hijacked firebase-adminsdk key, yet its billing team still won’t clear the charges. Google still offers no general spending cap, with its Spend Caps feature in private preview and a Gemini API cap that carries a 10-minute delay customers must pay for. Such charges can stick even after a bank reverses them as fraud, echoing earlier cases including a Vietnam developer’s claimed $82,000 in 48 hours in February.
