You see him, right?
The guy in your office. Stays late even when nothing’s behind. The one who brags about “saving cost” by using free AI models. He thinks he’s the team player. He’s not. He’s the dataset.
OpenRouter literally publishes the flag. “No Prompt Training.” Some routes: ✅. Others: ❌. And, surprise, the free ones? They’re the ❌. No trickery. It’s right there. Nobody reads it.
If it’s free, you’re paying. Not with dollars. With your prompts. With your screenshots. With your keys.
You know what happens when they paste too much?
Look at how developers actually use these tools.
They don’t just describe the bug. They paste everything. Full logs. Screenshots with the .env file still open. “AI needs context,” they say. And they’re not wrong. AI is better when you over-provide. But over-providing is also how you gift-wrap your Google API key and ship it straight into somebody’s training set.
This isn’t abstract. It’s not “someday maybe.”
- One company bled $450,000 in less than two months after a compromised Google key got abused.
- Another: $10,000 in four days.
- Devs report sudden Places API spikes they didn’t even generate. And Google’s alerts? Laggy. Sometimes hours, sometimes days. By the time you notice, it’s your credit card company calling.
But sure. Keep pasting. The model loves context. Your bank doesn’t.
They think it’s the model. It’s not. It’s the pipes.
Not magic. Just plumbing:
- Request logs. APM traces. Backups. Caches. Snapshots. Every system that “touches” your text keeps a copy.
- Some endpoints train on prompts. If you didn’t check the flag, you just volunteered.
- People see it too. Abuse reviewers. Red teamers. Labelers. “Quality assurance.”
- And if your agent calls a tool—sandbox, vector DB, pastebin—that system logs it too.
Memorization is possible, especially with repeated keys. But the real problem isn’t spooky model memory. It’s the boring infrastructure that never forgets.
You think budgets protect you? They don’t.
You think a budget will save you? Budgets don’t cap spend. They send an email. An email that lags. Sometimes by hours. Sometimes longer.
By the time you read “You’ve hit 100% of your $100 budget,” your card’s already declining charges at $10,000 and the bill is still going up.
The only real defense is pulling the plug yourself.
- Never paste secrets. Not in prompts, not in screenshots. Run a redaction wrapper. Restrict Google keys by API, referrer, IP. Rotate often. Delete when compromised.
- Separate blast radius. If you’re using Places, put it in its own project. That way when it blows up, it doesn’t take everything with it.
- Kill-switch your billing. Budgets won’t stop charges. Automation will. Wire Budget → Pub/Sub → Cloud Run → three steps:
- Disable billing.
- Disable the runaway API (like Places).
- Delete the leaked key.
Want to be extra safe? Double the budget target. If you only want to spend $50, set budget to $100, and kill everything at 50%. That way the lag still cuts before the bleeding kills you.
They didn’t even hide it.
The system isn’t lying to you. The flags are right there. OpenRouter even lets you filter out models that train. Nobody flips the switch.
The guy who stays late doesn’t read the fine print. He thinks he’s saving you money. What he’s really saving is someone else’s training set.
And when the alert finally lands in your inbox? It won’t be Google. It’ll be your bank.
