Alphabet's AI Expansion Faces a Cloud-Security Reality Check

Google Cloud revenues surged to $20.03B, but unauthorized API access incidents causing five-figure bills and key propagation delays threaten to overshadow AI momentum.

Alphabet turned in a blockbuster first quarter, but the narrative around its rapid AI expansion is growing more complicated. While Google Cloud posted explosive growth and the group’s overall revenue hit $109.9 billion — up 22% from a year earlier — a fresh debate about governance and security flaws is threatening to overshadow the momentum.

The cloud division alone generated $20.03 billion in revenue during the period, compared with $12.26 billion a year ago, and operating profit surged to $6.60 billion from $2.18 billion. A $462 billion backlog underpins that trajectory. Yet within those numbers lurks a different story: developers have reported unauthorized API access to Gemini models triggering five-figure bills in minutes. One documented case saw a $17,000 charge racked up after an automatic capacity upgrade; another involved a publicly exposed API key generating roughly $10,000 in usage costs over half an hour. Google says it compensates affected users when fraud or errors are clear, but security researchers have flagged a related issue — deleted API keys remained active for up to 23 minutes in tests. The company describes that as normal propagation behavior, while experts advise treating deletions as a 30-minute reaction window and monitoring for unusual activity.

These vulnerabilities come as Google Cloud COO Francis de Souza argues that AI security can no longer be left to IT departments. With agents, data pipelines, and language models expanding the attack surface, he says companies need built-in safety, governance, and traceability from the start. For Alphabet investors, that isn’t a quarterly blip — it’s a structural test. The division has become a core profit engine, and every new AI agent rolled out amplifies the importance of access controls and billing transparency. Later this summer, Google plans to launch information agents in Search for AI Pro and Ultra subscribers, with more agent-based features for bookings and personalized experiences to follow.

Alphabet is simultaneously pouring capital into adjacent AI ventures. Isomorphic Labs, its drug-discovery subsidiary, closed a $2.1 billion funding round led by Thrive Capital, with participation from Alphabet itself, Temasek, the UK Sovereign AI Fund, and Abu Dhabi’s MGX. The unit is now valued at between $10 billion and $12 billion. CEO Demis Hassabis, who also runs Google DeepMind, will use the funds to expand the IsoDDE platform, which relies on AlphaFold-3 technology to predict molecular behavior and accelerate drug development. Existing research partnerships with Novartis and Eli Lilly already exist.

The mothership is pushing deeper into hardware and autonomous AI too. At Google I/O earlier this month, CEO Sundar Pichai unveiled Gemini 3.5 Flash, a model designed for multi-step reasoning and independent task execution. Search is being re-engineered to handle complex queries autonomously. For autumn, Alphabet is planning “Googlebook” laptops with integrated Gemini — manufactured by Dell, HP, and Lenovo — as it seeks to embed AI directly into devices rather than offering it solely as a service.

That all rests on solid financial footing. Net profit in the first quarter jumped 81% to $62.6 billion, and earnings per share of $5.11 easily beat the consensus estimate of about $2.64. Alphabet increased its quarterly dividend to $0.22 per share, with an ex-dividend date of June 8 and payment on June 15.

Risks are mounting on other fronts. A Los Angeles jury ruled in late March that YouTube and Meta had promoted social media addiction. Alphabet is still fighting antitrust remedies, while its self-driving unit Waymo faces fresh safety concerns. As for the stock, it traded around €334, up nearly 25% since the start of the year — roughly four percent below the May peak. Bank of America recently reiterated a buy rating with a $430 price target, citing the growth potential of AI-integrated search.

Whether the market continues to reward Alphabet’s aggressive AI push will depend less on compensation for isolated API incidents and more on whether enterprise customers and developers maintain trust while Google accelerates its cloud and agent rollouts. The next few quarters will reveal if growth rates can hold.