A stolen Gemini API key turned a $180 bill into $82,000 in two days