| ✦Duolingo Told Employees to Use AI. They Faked It. | FULL STORY |
| ✦Google Deprecated Gemini 2.0. Production Broke Overnight. | FULL STORY |
| ✦He Set a $10 Budget Alert. Google Charged $25,672. | FULL STORY |
Good Morning Thorium Valley, welcome back to the Catalyst Newsletter.
Today we've got the story of a CEO who told every employee to start using AI, tied it to their performance reviews, and then watched people fake their way through it until he had to scrap the whole thing.
We're also looking at what happened when Google killed two AI models that companies had been building on for over a year. Production systems broke overnight and the migration path isn't much better.
And then there's a developer who set a $10 spending alert on his Google Cloud account before bed and woke up to a bill for $25,672. What happened when he called support is even worse.
IN THIS ISSUE 1. Duolingo Told Employees to Use AI. They Faked It. 2. Google Deprecated Gemini 2.0. Production Broke Overnight. 3. He Set a $10 Budget Alert. Google Charged $25,672.
Quickly before we dive in — When AI gives you a result, how much do you trust it before double-checking?
WORKFORCE
Duolingo's employees had one question for their CEO. Do you just want us using AI for AI's sake?
In late 2024, Luis von Ahn pushed a company-wide plan that tied employees' AI usage to their performance reviews. In an internal memo, he said Duolingo would move with urgency on adoption and accept occasional small hits on quality. The goal was to get everyone — not just engineers — using AI tools in their daily work.
What actually happened is what tends to happen when you measure the tool instead of the work. Employees started cramming AI into workflows where it added friction, created extra review cycles, and produced worse output. Not because it helped, but because it showed up on a scorecard.
"It felt like, rather than being held accountable for the actual outcome, we were trying to just push something that in some cases did not fit," von Ahn said on the Silicon Valley Girl podcast in April 2026.
So he pulled the whole thing back. The only metric that matters now is whether you're doing your job well. By May, von Ahn was telling Stanford's Graduate School of Business that human designers at Duolingo still outperform AI on creativity and polish, and that the company would not lower its quality bar to hit an adoption target. AI did great work when it was matched to a specific problem. It collapsed the moment adoption became the point.
Von Ahn isn't the only CEO recalibrating. Mark Zuckerberg reportedly acknowledged that Meta made mistakes during its own AI workforce restructuring, and as Gizmodo has reported, CEOs are quietly stepping back from the aggressive AI rhetoric that dominated 2025. But most of those reversals are about headcount. Von Ahn's finding is more specific and more useful: you can have AI tools that genuinely work and still destroy their value by making adoption a performance metric.
According to a 2025 Writer report, 31% of employees across industries were actively resisting their company's AI rollouts — some tampering with metrics, others doing work by hand and reverse-engineering an AI trail so management would see the right numbers. Von Ahn is just the one who said out loud that it didn't work.
Into the Valley: Von Ahn ran the AI mandate experiment that every other CEO is considering and then did something almost nobody does. He published the results. AI adoption works when it solves a problem people already have. It collapses when it becomes the metric itself. If your company is building an AI usage scorecard right now, or tying adoption to promotions, or tracking token counts on a leaderboard, Duolingo just showed you how that movie ends. Measure the work and let the tool follow.
STRATEGY
Alberto Gimeno started hearing from clients the morning of June 1. Google had just shut down Gemini 2.0 Flash and Flash-Lite, two AI models that companies had been building production systems around for 16 months. The pipelines his clients spent months fine-tuning were suddenly producing garbage.
Gimeno runs Invofox, a document processing platform serving more than 100 software clients. One financial services client had spent three months calibrating extraction prompts specifically for mortgage documents. When the model disappeared, they got about two weeks of scrambling to make everything work again on a new one — and when the replacement model carries even a modest per-call pricing increase at that scale, costs spike without warning while engineering teams rebuild.
"When the model you built on gets deprecated, your engineering team owns every fix, every regression, and every hour of downtime," Gimeno wrote in Forbes.
The migration path Google is offering doesn't make things easier. According to Google's deprecation documentation:
+ The recommended replacement for Gemini 2.0 Flash is Gemini 3.5 Flash — two full generations forward. Every prompt tuned over months has to be re-validated against what is essentially a completely different system.
+ Teams that play it safe by migrating to Gemini 2.5 Flash instead get another forced migration by October, because that model's shutdown date is already on the calendar. Four and a half months of runway before doing the whole thing over again.
Google isn't alone. OpenAI announced its Assistants API shuts down Aug. 26, pushing developers onto the newer Responses API. Then it separately announced that Prompt Objects — the feature many developers migrated to after Assistants — also dies Nov. 30. Developers are being asked to migrate from A to B before B has even finished replacing A. We covered the upgrade version of this problem earlier this month when Sherwin-Williams had a production pipeline break after Anthropic updated Claude. With an upgrade, you can at least roll back. With a deprecation, the model you'd retreat to is gone.
Gimeno's advice is to build a "model-agnostic abstraction layer" — architecture where the AI model is swappable plumbing rather than the foundation, so when one gets killed, the system routes to the replacement without rewriting everything from scratch. It's the kind of thing that sounds obvious after your third forced migration and completely theoretical before your first.
Into the Valley: Every software API gets deprecated eventually but traditional API replacements are generally deterministic. Same input, same output. AI model replacements are probabilistic systems with different behaviors and different failure modes, and that often makes every migration a partial rebuild rather than a clean swap. The question for anyone running AI in production is no longer whether they'll have to migrate but how many times per year and what that line item actually costs. Model deprecation isn't an event. It's rent, and almost nobody has budgeted for it.
ENTERPRISE
Jesse Vent set a $10 spending alert on his Google Cloud account before going to bed. He woke up to $25,672.86. Overnight, roughly 60,000 unauthorized API requests had been made through a key that Vent says doesn't exist anywhere in his project. He has five valid API keys. Google's investigation pointed to a sixth one he's never seen.
When he called support, he got routed to AI agents that could only see a balance of 13 cents. When he finally reached a human, they told him to disable billing — which wiped out his logs. Then they asked him to prove he'd been hacked. While he was still on the phone, unauthorized requests were still pouring in by the thousands. Their response, according to Vent: "That's what happens when you use our services."
He's far from alone. Another developer reported that unauthorized Gemini API charges pushed their bill to roughly $128,000, with no real explanation from Google months later. A small startup was hit with $82,314 and warned that enforcing even a fraction of it would bankrupt them. The attacks all follow the same playbook: they hit between 3 and 5 AM, target the most expensive API calls available, and run until somebody wakes up.
When you create a Gemini API key, Google's defaults are the common thread in every case:
+ Restrictions are off. Any IP, any referrer, any service can use your key.
+ Monthly spend cap is blank. It didn't exist before March 2026, and older keys still have nothing set unless you've manually changed it.
+ Logging is off. You have to go turn it on yourself.
And the attacks aren't always coming from stolen keys. Vent figured out that attackers found a Cloud Run service he'd published from AI Studio months earlier, hit the public URL, and Google's own proxy authenticated every request on their behalf. The budget alerts that are supposed to catch this? Google's own documentation says they're notification-only — they send you an email but will not stop the charges. AWS Budgets can trigger automated actions that kill instances at a dollar threshold. Azure's free accounts have a hard cap on by default. Google doesn't offer anything comparable for Gemini API usage.
Google eventually waived Vent's charges. A support agent acknowledged that "a lot of users are seeing a spike in the usage for the Gemini API services" and that an internal team was looking into it. But for many victims, even getting a resolution has been its own ordeal — one developer who was promised a refund said the credit never showed up and Google then disabled payments on their account entirely.
Into the Valley: Three product decisions made all of this possible. API keys that are unrestricted by default, budget alerts that notify but don't enforce, and logging that's off unless you turn it on. Each one is individually defensible. Together they create a system where someone can find your old API key at 3 AM and burn through five figures before your budget alert email even lands. Google has been promising fixes for months, and the fixes keep arriving after the next round of victims. Anyone with a Gemini API key right now, and that includes people who opened AI Studio once and forgot about it, should go check their defaults tonight.
EVERYTHING ELSE IN AI
+ 42 state attorneys general just served OpenAI a subpoena and for the first time, regulators are targeting how a model behaves, not just what a company does
+ Commerce Dept. threatened Anthropic with criminal charges over its Fable 5 and Mythos 5 models, forcing a global shutdown
+ DOJ argues xAI's polluting gas turbines are vital to national security and tries to kill NAACP's Clean Air Act lawsuit
+ A German court ruled Google is liable for false claims made by its AI Overviews, rejecting the "AI makes mistakes" disclaimer defense
+ Court dismisses xAI's trade secret lawsuit against OpenAI , ruling that hiring away employees isn't theft
+ Nvidia is planning a $20 billion bond sale , its first since 2021, with debt stretching out to 2056
+ A Johns Hopkins poll found 70% of Americans want the right to talk to a human instead of AI — even daily AI users want more regulation
+ Genesis AI unveiled a general-purpose robot that ditches the humanoid form for a folding wheeled design headed to factories this year
OTHER TOOLS
+ Wispr Flow: *(sponsored)*: The new viral voice-to-text AI for iPhone and Mac that actually understands what you're saying every time
+ Superpower: *(sponsored)*: The health app that tests your blood and uses AI to tell you what's actually going on with your body before your doctor does
+ Facebook AI Mode: Meta added an AI-powered search tab to Facebook that pulls answers from real people's posts, Group discussions, and Reels — so instead of getting generic links, you get actual opinions and recommendations from the community
+ monday.com for Gemini: You can now manage your monday.com boards entirely from Google's Gemini using natural language — create tasks, update projects, and check statuses without ever switching tabs
+ Mellum2: JetBrains open-sourced a lightweight coding AI model that runs entirely on your own machine, built for developers who can't send proprietary code to external servers like Claude or ChatGPT
+ NVIDIA ACE: NVIDIA released a toolkit that lets game developers build AI-powered NPCs that actually listen, reason, and respond to players in real time — already tested in Total War: PHARAOH where an in-game advisor can answer questions by pulling from 1,200+ game data tables
+ Copilot Cowork: Microsoft's new Copilot feature goes beyond drafting emails and summaries — it can now carry out entire multi-step business processes across your documents, apps, and data sources on your behalf, and it's now available to everyone after more than half the Fortune 500 used it in preview
That's the Catalyst for this issue. If you know a company doing something interesting with AI that nobody's covering, reply and tell us about it.
Written by Jason Chen, Advait Prakash, Andrew Hales, and the Thorium Valley crew.
That's all for today's Catalyst. See you next time.