Google Cloud Project Suspended After a Gemini Key Leak? What to Do (2026)

On October 17, 2026, a paying Google AI Ultra subscriber found their entire Google Cloud access restricted, with an error reading "Entire service unavailable". Their explanation, posted to Google's AI developer forum six days later: an AI coding assistant had hardcoded their Gemini API key into code that ended up public. Antigravity went down with it. It isn't a one-off. The same forum has a steady run of threads going back to May 2026 where a Gemini key got out and the whole project it belonged to was switched off.

What a suspension actually switches off

Every Gemini API key belongs to a Google Cloud project. Google's API key docs say so in one line, and it's the line that matters here. If you made your key in AI Studio, it lives in an auto-created project; forum posters show these as "Default Gemini Project" with an ID like gen-lang-client-0123....

Google's project suspension guidelines are blunt about scope: "If Google suspends a Google Cloud project then all the associated Google Cloud workloads will be suspended as well." So if your Firebase Auth, Cloud Run backend, Maps key and Gemini key all share a project, they all stop. One May thread describes exactly that: the suspension also disabled the developer's Google Maps Platform and the Google OAuth client running on the same project, services that had nothing to do with the abuse.

It can go wider. The same guidelines describe a separate account suspension, where a user "consistently violating" the terms through their projects loses access to Google Cloud entirely (Gmail keeps working). Two October threads report landing there:

• Restricted on September 3, a day after two AI Studio projects were suspended for hijacked resources. The poster believes their key leaked but doesn't say how.
• Restricted on October 17 after an AI coding assistant exposed the key. This is the clearest leak-to-account case we found.

All of these are self-reported, and Google staff haven't confirmed the cause in any of them. But the pattern is consistent enough to plan around.

What to do, in order

1. Appeal from the console, signed in as the owner

The email comes from google-cloud-compliance@google.com. Google's policy violations FAQ says to fix the issue and submit an appeal from the Appeals page in the Cloud Console, which you reach through the link in that email. You have to be signed in as the project owner.

If the page says you don't have permission, Google's own fix is to log out of every other Google account and click the link again. Most founders are signed into a personal and a work account at once, so try this before assuming you're locked out.

Google says appeals get an answer "in most cases" within two business days. The forum threads above report weeks of silence, so file it the day you get the email.

2. Find the leak before you explain it

An appeal that says "I rotated my key" without saying how it leaked is weak, and so is the fix. Check where the key actually was:

• Your live JavaScript bundle. Open your deployed site, view the JS files, and search for AIza, the prefix Google API keys start with. Older AI Studio exports compile the key into the browser bundle even if you never put it in the project.
• Your git history, including commits you later "fixed". A key removed in a later commit is still in the history.
• A Firebase browser key in the same project. One May thread traces a suspension to a legacy Firebase client key that could also call Gemini. Firebase config keys are meant to be public, so if Gemini is enabled in that project, check that the Firebase key isn't allowed to call it.

3. Kill the key wherever you can still reach it

Suspension can block the tools you'd use. One developer reports that every management API returned permission denied and the console redirected to the appeal form, though Cloud Billing was still readable. Do what you can:

• Delete or disable the key in AI Studio if it still loads.
• Remove it from your code, your hosting provider's environment variables, and anywhere else it was pasted.
• In the appeal, list exactly what you removed and where the leak was.

Google may already have blocked it. Its troubleshooting page says keys it detects as leaked get the error "Your API key was reported as leaked. Please use another API key."

4. File a billing case separately

The appeal is about getting your project back. The charges are a different conversation. Google's troubleshooting page points unexpected charges to a Cloud Billing support case. Pull what you can from Cloud Billing first (the SKUs and dates of traffic you didn't generate) and attach it. Our stolen API key runbook covers the evidence to gather.

Once you're back: shrink the blast radius

This is the part we'd push hardest on, because it's cheap and it's the difference between "Gemini was down" and "the whole business was down".

• Give Gemini its own project. Don't put your production backend, your Auth and your experimental Gemini key in the same Google Cloud project. A suspension takes out everything in the project it lands on.
• Separate CI and test keys. Give automated tests their own key in their own project, with a low request quota, so a retry loop hits a wall instead of your account.
• Never ship the key to the browser. Google's own docs say to call Gemini from a backend proxy, not from web or mobile code. Our scanner flags Google API keys (the AIza... pattern) in deployed JavaScript for exactly this reason.
• Watch the owner inbox. Google says emails from google-cloud-compliance@google.com are how warnings arrive, and you get "a limited time window" to fix things. Make sure they don't land in spam. Some suspensions come with no warning at all if Google treats the activity as an emergency.

Projects don't disappear overnight. The guidelines say a project suspended for nine months is marked for deletion. You have time to appeal properly, just not unlimited time.