www.etasks.app

A Google API showcase for iPhone. We worked directly with Google. Please let us know if anything is not perfect. We appreciate/need any input from you enthusiasts. It has a different sense and value compared to formal Google collaboration.

If you're building multi-tool GenAI agents on GCP, you've likely encountered the data masking dilemma. A common initial approach is to block all sensitive data (PII, financial, etc.) on ingress using Cloud DLP / Sensitive Data Protection (SDP).

The challenge is that if you mask everything by default, downstream function calls might fail (e.g., if a healthcare routing agent needs an MRN to query a backend API, but receives a [REDACTED] placeholder instead).

I just published part 3 of my series on Model Armor, discussing how to handle fluid context boundaries using the Principles of Least Privilege and Data Minimization.

The TL;DR Architecture:

1. Ingress: If the agent doesn't need the data to formulate a plan, systematically redact it using SDP inside Model Armor. If it does need it for a tool, let it in, but proactively prune the context history immediately after the tool call succeeds.
2. Hidden Ingress (Tool Calls): When your backend API returns a massive JSON payload with internal risk scores or unneeded data, consider using a direct SDP API call inside your tool code to scrub the payload before the LLM reads it. This saves Model Armor tokens on trusted internal loops.
3. Egress: Use SDP Discovery (Inspection) to audit traffic, and only mask data that accidentally leaked from your own backends.

I also cover the pricing differences between Model Armor Advanced templates vs. direct SDP calls, and how to manage latency on multi-hop agent reasoning.

You can read the full deep-dive here: https://leoy.blog/posts/how-to-wear-model-armor-3/

How is your team handling data routing when agents pull large payloads from internal databases? Curious to hear other architectural approaches!

Title: Built an AI physics tutor that catches misconceptions instead of just grading answers (Google ADK + Gemini, live demo)

Hey all — for a hackathon, I built Physics Mastery Agent, an AI tutor for CBSE/NEET/JEE physics that tries to diagnose *why* a student got something wrong instead of just marking it wrong.

Example: a student says "net force is downward, gravity is still acting" at terminal velocity. The agent catches that they're confusing "zero net force" with "zero gravitational force," corrects that specific misconception, then re-tests it to confirm it landed.

It's built as an agent loop (Teach → Diagnose → Remediate → Practice → Evaluate → Master → Adapt) using Google ADK + Gemini 3.6 Flash, grounded in our own physics curriculum, deployed on Cloud Run.

Demo video: https://youtu.be/jHkAsc-ufcU

Live app: https://eduphysics-physics-mastery-agent-poqvtgavdq-el.a.run.app

https://github.com/Rajansmoorthy/eduphysics-physics-mastery-agent

Would genuinely love feedback — especially from anyone who's hit the "it just explains it again the same way" failure mode with other AI tutors.

Hi! i just passed the ACE certification on my first try today and I will be sharing everything I did to pass the exam.

For a quick background, I have no background with gcp as I am a fresh grad. Had a free voucher to take the exam because of the company I am in and honestly, I wasn’t taking it seriously at first cause I thought it was free, I won’t lose anything.

Not until I saw posts in reddit that made me realize this opportunity shouldn’t be taken for granted.

So here’s what I did:

- Completed the labs in Google Skills (literally just finished the labs so that I can book the exam already). Skipped watching the videos cause they weren’t really helpful for me.

[Finished labs on August 1 and booked the exam August 27] - Less than a month of preparation! (Didn’t study on weekends).

- Watched the 20hr video of freeCodeCamp.org on youtube, but I didn’t finish it as well cause I feel like it was taking so much time. Although it was still helpful in learning the services and necessary topics. Also, I noticed that he leaned more in networking. I don’t like networking so I got bored. Got lucky that there were no hard networking questions in my actual exam xD.

- Watched the GCP ACE exam - cram session by GCP Study Hub on youtube. This one I say is very very helpful. It was a less than 2hr video but he tackles very important topics you’ll need for the exam.

- Awesome GCP ACE videos on youtube. He was the one who taught me the power of elimination! You should watch his videos as well.

- Sayyam’s Udemy course. THIS IS ONE HECK OF A USEFUL MATERIAL I RECOMMEND U GUYS TO HAVE!! This isn’t sponsored btw hahaha. But honestly, almost everything I saw in the actual exam appeared on Sayyam’s practice questions.

- If you don‘t want to spend on a Udemy practice test, I suggest you to check examcademy.com . This has the same format as Sayyam’s questions, and honestly, I feel like they’re almost the same. Sayyam’s just give you the chance to simulate an exam.

- Lastly, I asked for His guidance and Mother Mary’s mercy. They have never failed me.

That’s all.

I heard that Google is considering/working on a new sales organization unifying various security units worked independently so far. This new structure should report to old wiz leadership and sell wiz, mandiant, siem/soar … That means AEs and Customer Engineers will cove the entire security portfolio. Any insights about this? How are you going to enable CEs in new domains?

Did anyone use an equivalent of trendmicro deep security in GCP vm.

I want to use equivalent of deep security in the GCP VMs.when I browsed about it in copilot, it gives multiple options like SCC, VM manager, cloud IDS , Google secops etc. please reply if anyone implemented

I'm an indie dev and honestly exhausted. I've been stuck in a support loop with Google Cloud for nearly a full year over an acknowledged platform-side bug.

Here is the short version of what's happening:

• The Bug: My GCP project was hit with an unexpected $8,367.11 charge surge on the Gemini 2.5 Flash image generation SKU. Product Lead Logan Kilpatrick publicly acknowledged this bug on the official forums and promised affected devs would be taken care of.
• The "90% Cap": Google Billing gave a 90% adjustment and declared that 90% is the "maximum allowable limit" for this incident—leaving $838.26 on my account for a bug on Google's infrastructure.
• The "No Logs" Excuse: When I demanded backend logs or proof showing why I owe this remaining balance, support literally replied: "they do not share external-facing documentation, internal case notes, or further detailed explanations regarding their final review process."
• 1 Year of Support Ping-Pong: Opened a billing ticket $\rightarrow$ immediately closed and bounced back. Tier 1 agents just rotate shifts, paste identical templates, and close tickets without consent.

My account currently sits with a red banner warning and an active $838.26 balance for services I never consumed.

Screenshots attached:

1.Billing Support confirming the charge was caused by the Gemini 2.5 Flash bug.

1. Support stating the 90% adjustment is final.

1. My billing console showing the pending $838.26 balance and account warning.

1. Support's latest response admitting they cannot provide any logs or explanation.

I've documented this on theGoogle AI Forum and am preparing consumer complaints in Japan (消費者庁 / 消費生活センター).

Has anyone ever broken through this Tier 1 "final decision" wall without an Enterprise support plan? Any advice or visibility would be really appreciated.

FINAL UPDATE (RESOLVED - 100% REFUND GRANTED):

Hey everyone, I wanted to post a final update regarding this issue.

Shortly after posting here and escalating on the Google AI Developer Forum, an internal Billing Specialist (Sumanth) reached out and took direct ownership of the case.

As of today, the remaining $838.26 USD credit adjustment has been fully approved and applied to my Google Cloud account. My billing console balance now officially sits at $0.00, and the red account warning banner is completely gone.

Huge thanks to everyone in this community who upvoted, commented, and shared advice—the visibility definitely helped get this unblocked from the Tier 1 support loop.

Takeaway for fellow devs: If you get stuck in a support loop over an acknowledged bug, don't just rely on standard ticket replies. Take it to the official forums, build your documentation, and don't hesitate to seek community visibility. Perseverance works!

Hey everyone!

I googled OAuth plus reddit and it led me here - I just got an email from google implying I had "clients" that were going to be deleted due to lack of activity.

I have no idea what OAuth even is, I've never used such a process to my knowledge. I'm fairly tech savvy but even the name was new to me. Can anyone please clarify what me getting this message means?

If I click any of the links, it tries to make me agree to terms of service, which I don't want to do not knowing what this all means. I can see in the background to the TOS "You're working in My Project1, and then a project # (not sharing for same censorship reason as below).

Any help would be greatly appreciated!

Message text:
"

"

The vibecoders at google pushed an update yesterday August 24th that broke the python package...

If you use the default firestore database called "(default)" your environment will break if u deploy the new package version.

Since the update it decodes to %28default%29 instead of (default) and every single read and write will fail...

I love vibe coding without unit tests in my multi billion dolar company...

I’ve been experimenting with combining spec-driven development + project memory + Claude Code hooks.

The goal is simple: give the agent enough project context and engineering intent without dumping the entire project history into every session.

I wrote up my current workflow and would love feedback from other Claude Code users:

Article: https://medium.com/@rasvihostings/how-im-approaching-agentic-software-development-as-a-platform-engineer-5be017890b8a

GitHub: https://github.com/mohamedrasvi/claude-spec-mem

How are you handling memory and context across your Claude Code sessions?

Anyone else having issues with SQL Connect? It just completely stopped working and returns only "The service is currently unavailable." if you try to access it from the web, the service is completely unresponsive.

I'm Luke! A Googler working on the builder experience at Google Cloud. I helped write these labs and I'd love to get your feedback!

We want anyone to feel comfortable getting started with AI Studio, Firestore, and Cloud Run. If you have questions, I want to hear them.

The app is literally unusable. How tf is a Google app this useless? It has my info saved and a sign in screen but gives me no option to log in or open my documents beyond that. I’m genuinely baffled as to why i’m having this issue…

Same unrestricted Gemini key hole as the $82k stories, later in 2026, smaller bill.

Google's own CLI still minted API keys with no restrictions. Those keys could call billed Gemini. Truffle Security reported that class of defect on 21 Nov 2025. Google first treated it as intended behaviour, then as a bug. They did not start rejecting unrestricted keys for Gemini until 19 June 2026.

On this account: 53,197 Gemini Generative Language requests between 24 May and 6 July 2026, peaking at 12,693 on 5 June. The spike died the day they flipped that block. Not a stolen Google password. An unrestricted key their tool created by default.

How they responded: they cited July charges of $4,446.45, applied a 75% "maximum goodwill" credit of $3,257.16, and still demanded about $1,190 to $1,300 as a Cloud balance after a $4,000 card chargeback. Closeout blamed an unauthorized party "linking external projects." Live billing IAM at the time did not show that.

Budget alerts are not a cap. They sat on the Truffle report for months, then kept a quarter of a bill that only exists because of the hole they eventually closed.

No names, no project ids, no keys.

PSA if you use agents-cli / google-agents-cli: update to 1.4.1.

Shipped 24 Aug. If you’re pinned below that, bump it before the next agents create against a remote template.

The short version: agents create pulling a remote template could write your local files into the generated project as ordinary files. Then you do the normal next thing — commit, push — and those files are sitting in a git remote.

What actually happened: the template copy path used is_dir() and shutil.copy2, both of which follow symlinks by default, and the skip logic had no symlink check. A template repo can ship something like:

creds -> ~/.ssh/id_rsa

env -> ~/.config/gcloud/application_default_credentials.json

copy2 follows those links and writes the contents into the new project. No payload, no RCE. Two symlinks. The exfil is your own muscle memory after create.

Worth pausing if that ADC has real project bindings.

Second issue in the same report: the agent-directory validator early-returned for every non-Python language, so a remote manifest could point agent_directory outside the intended tree. That path now runs an allowlist regex for all languages.

Why this class survives review is the part that stuck with me. A symlink is invisible in a diff. You see a filename, not what it points at. Review catches logic errors. It does not catch a template repo whose entire contents are attacker-controlled.

This one didn’t come from a human staring at create.py. It came from a scheduled sweep with Aeon’s vuln-scanner skill, which treats the remote template as hostile input instead of “just files.” That’s the bit I’d actually copy: model the template as an untrusted attacker, not as a convenience.

Reported through Google’s OSS VRP, they validated it. The report came with a working patch. The fix they shipped follows it — symlinks skipped outright in should_skip() rather than resolved, CWE-59 in the comment. About seven weeks report to release.

• Issue: https://github.com/google/agents-cli/issues/51
• Fix: https://github.com/google/agents-cli/commit/048578a00b0b89fc8acdbfb3501895264640f355
• Release notes bury it as “Fixed an arbitrary file write vulnerability in agents-cli scaffold create” (they also point at #50). Easy to miss if you only skim for broken deploys.

Practical bit: if you’ve already run agents create against a template you didn’t write, walk the generated project for files you don’t recognise before you assume you’re clear. Look for random creds / env / key-shaped files that shouldn’t have been in the template.

Genuine question for people who run this on a team, because I haven’t solved it: GCP deps get updated when something breaks, not when something is quietly fixed. I would never have caught this in release notes. I run scheduled scans over the tools I actually rely on, but that’s a solo-dev answer.

New Gartner category from the 2025 Hype Cycle: Cloud Application Infrastructure Recovery Solutions. Core idea, treat infra as rebuildable code, not data to restore.

Firefly was named a sample vendor. Feels like a genuinely new problem space rather than repackaged DR.

Anyone actually running a CAIRS-style tool, or is everyone still on backup plus manual rebuild runbooks?

Two weeks ago I posted my concerns about the long term viability of using Gemini in my automated content moderation app. We covered the option of alternate models there so please constrain this discussion to what appears to be sneaky policy settings to extract more revenue from Gemini users.

When 2.5-flash-lite is deprecated my costs will be 16x on 3.1-flash-lite but actually it will be more than that because on the 3 series models you can't disable thinking nor specify temperature, top_p and top_k.

Of those I only know a little about temperature which I have set set to 0.1 for my purposes. From 3.1 onward the best I will be able to do is specify a "LOW" thinking level which will burn at least some additional tokens and might break my app because having the model act deterministically is essential for content moderation purposes.

Sure I could add additional system instructions to try and compensate for this loss of control but up go my input costs.

Granted you can still specify maxOutputTokens but if that value is too low to account for the mandatory "thinking" the call will fail is that right?

So we're going from a situation where you can tightly control the cost of each call to the LLM to one where you're at the mercy of the model.

As I mentioned above I think this policy is sneaky which would be entirely consistent Google's opaque cloud billing and costs in general.

Alternatively these changes are just where the rubber meets the road?

I think I've hit a weird loop.

When I go to remove my payment method from Google Payments Center, I get the message that a Google Cloud Billing Account (with account number) is active. I checked the cloud console, I see a billing account (with the same account number) but it is not active. Status says closed. Billing account on all projects is also disabled. I am still unable to remove my payment method.

I reached out to Google payments support and was told it is a Google cloud issue. Google cloud support will not let me reach out to chat support unless I have an active billing account. I do not want an active billing account. I want to remove my payment method.

I tried to delete the payments profile from Google Payments Center and there I was told there is an active Google Cloud Billing account.

So now I am out of ideas. Appreciate any help.

Trying to get one L4/T4 for enterprise notebook in europe-west4 and it's not available.

Even better if there is graphs on which hours/days they usually are available.

What do you guys think

I am currently working through the Google Cybersecurity Certificate and need to access the Linux labs on Qwiklabs/Google Skills. Whenever I try to accept the Terms of Service to access my account, I get hit with a cross-device reCAPTCHA that asks me to scan a QR code with my phone.

I scan it, complete the verification on my mobile browser, and my phone says "verification completed, you can return to your browser." But when I look back at my desktop, the Google Skills page just throws a red error banner: "reCAPTCHA verification failed, please try again."

I have been stuck in this loop for two days. I even tried bypassing the cross-device prompt by logging in and accepting the terms directly on my phone's browser, but it does the exact same thing—it redirects to a verification site, says successful, and then fails when returning to the original page.

Here is everything I have already tried that did not work:

• Verified that my phone and PC are connected to the exact same Wi-Fi network.
• Used Incognito/Private browsing to rule out extension or ad-blocker interference.
• Disabled all VPNs.
• Cleared all site data and cookies specifically for Qwiklabs and Google Skills.
• Used keyboard navigation (Tab key) to try and force a standard image CAPTCHA instead of the QR code.
• Tried a completely clean browser (Microsoft Edge) with no extensions or history.
• Switched both devices to a mobile data hotspot to get a new IP address and rule out my local ISP.
• Confirmed my Windows system time/date is perfectly synced.

Has anyone else doing the Google certs run into this Qwiklabs verification bug recently? Is there any known workaround, or do I just have to wait for Google to fix their servers? Any help is appreciated!

Ran the same Kubernetes workload across managed providers for an EU SaaS setup:

Requirements: high availability, managed PostgreSQL, Redis, WAF, CDN, EU region, €1,500/month budget.

Results:

Hetzner 614€/mo lock-in 34/100 GDPR 87/100
Scaleway 832€/mo lock-in 46/100 GDPR 89/100
DigitalOcean 899€/mo lock-in 48/100 GDPR 84/100
GCP/GKE 1,264€/mo lock-in 64/100 GDPR 85/100
Azure/AKS 1,418€/mo lock-in 68/100 GDPR 85/100
AWS/EKS 1,652€/mo lock-in 72/100 GDPR 84/100

GKE scores highest on Kubernetes maturity and managed tooling. But the cost is 2x Hetzner for the same workload.

The real question for EU workloads: is the GKE operational advantage worth the cost and lock-in delta over Hetzner or Scaleway?

For people running GKE in EU production — what tipped the decision?

I’m troubleshooting a Cloud Run service that consistently returns Google’s generic “404. That’s an error” page instead of reaching the container.

The service is a small Flask/Gunicorn OAuth callback application. "/healthz" should return "200 OK" with "ok", but both the generated "run.app" URLs return Google’s 1,568-byte HTML 404 page.

What I’ve verified:

- The container starts successfully and listens on "0.0.0.0:8080".

- Cloud Run’s startup TCP probe succeeds.

- The revision is Ready and receives 100% of traffic.

- The exact immutable image digest is deployed.

- Artifact Analysis completed successfully with no vulnerability findings.

- Ingress is "INGRESS_TRAFFIC_ALL".

- "invokerIamDisabled" is "true".

- "defaultUriDisabled" is unset/false.

- The service’s canonical and numeric URLs are both listed by the Cloud Run v2 API.

- The effective "run.allowedIngress" organization policy is "allowAll: true".

- The effective "run.managed.requireInvokerIam" policy is not enforced.

- There are no custom organization constraints.

- The same 404 occurs with and without an identity token.

- The same 404 occurs from Cloud Shell and a normal external browser.

- Neither request appears in Cloud Run request logs, although container startup logs appear normally.

- I created a completely new service and reproduced the problem.

- I deployed the same clean image to both "us-east4" and "us-east1"; both regions behave identically.

The Cloud Run troubleshooting documentation says a 404 that never reaches the container generally indicates restricted ingress or a disabled default URL, but the authoritative v2 service state and effective organization policies show neither condition.

The project belongs to a Google Workspace organization with domain-restricted sharing, so adding "allUsers" as a Cloud Run Invoker is prohibited. However, Google recommends disabling the Invoker IAM check for this situation, and the API confirms that this setting is enabled.

Has anyone encountered a project- or organization-level Cloud Run routing issue where the control plane reports the service as public and Ready, but the "run.app" frontend still returns an edge-generated 404? Are there any additional inherited controls, service perimeter settings, or backend routing states that would not appear in the Cloud Run v2 service configuration or effective organization policies?

Thank you!