Gemini 3.1 Flash Image

https://x.com/artificialanlys/status/2027052241019175148?s=46

I've been working recently on a open-source tool called LawBreaker that generates adversarial physics questions designed to trip up LLMs. The questions embed traps like anchoring bias ("my colleague says the answer is 35V"), unit confusion (mA vs A, Celsius vs Kelvin), and formula errors (using r instead of r-squared). Answers are graded with symbolic math, not LLM-as-judge.

Ran the latest version (v0.6) against 6 frontier models, 170 questions each, same seed so every model gets identical questions. Gemini came out on top by a wide margin.

|Model|Score|95% CI|
|:-|:-|:-|
|**Gemini 3.1 flash Img**|**83.5%**|77.1 - 88.5%|
|**Gemini 3.1 flash Lite**|**72.9%**|65.9 - 79.1%|
|Claude Sonnet 4.6|64.7%|57.2 - 71.6%|
|Claude Opus 4.6|62.4%|54.8 - 69.3%|
|GPT-5.4 Mini|58.2%|50.6 - 65.5%|
|GPT-5.4 Nano|25.3%|19.2 - 32.4%|

Some things I noticed about Gemini specifically:

* Flash image-preview scored 100% on Ohm's Law, Kirchhoff's Current/Voltage Laws, Newton's Second Law, Kinetic Energy, and several others. It's the only model that aced that many laws.
* On single-step physics problems, Gemini flash image hit 89% average. That dropped to 60% on multi-step chain questions (where you solve one law and feed the result into another), but that's still the best of any model tested.
* Where Gemini struggled: Bernoulli's Equation (worst law), Force to Kinetic Energy chain (0%), and Spring to Speed chain (20%). These are mostly multi-step reasoning problems with unit traps baked in.
* Flash Lite also performed well at 72.9%, beating both Claude models. For a lighter model, that's a strong result.
* Both Gemini models handled the anchoring bias traps well -- questions where a fake "colleague's answer" is embedded to mislead the model. Claude and GPT fell for these more often.

For context, the v0.5 leaderboard with 21 models has Gemini 3.1 flash image at #1 and flash lite at #2 as well, so it's consistent across runs.

The whole thing is open source if anyone wants to run it themselves or look at the per-law breakdowns:

* GitHub: [github.com/agodianel/lawbreaker](https://github.com/agodianel/lawbreaker)
* Full results: [huggingface.co/datasets/diago01/llm-physics-law-breaker](https://huggingface.co/datasets/diago01/llm-physics-law-breaker)

I've been building an open-source tool called LawBreaker that generates adversarial physics questions designed to trip up LLMs. The questions embed traps like anchoring bias ("my colleague says the answer is 35V"), unit confusion (mA vs A, Celsius vs Kelvin), and formula errors (using r instead of r-squared). Answers are graded with symbolic math, not another LLM.

Ran the latest version (v0.6) against 6 frontier models, 170 questions each, same seed so every model gets identical questions. Gemini came out on top by a wide margin.

|Model|Score|95% CI|
|:-|:-|:-|
|**Gemini 3.1 flash Img**|**83.5%**|77.1 - 88.5%|
|**Gemini 3.1 flash Lite**|**72.9%**|65.9 - 79.1%|
|Claude Sonnet 4.6|64.7%|57.2 - 71.6%|
|Claude Opus 4.6|62.4%|54.8 - 69.3%|
|GPT-5.4 Mini|58.2%|50.6 - 65.5%|
|GPT-5.4 Nano|25.3%|19.2 - 32.4%|

Some things I noticed about Gemini specifically:

* Flash image-preview scored 100% on Ohm's Law, Kirchhoff's Current/Voltage Laws, Newton's Second Law, Kinetic Energy, and several others. It's the only model that aced that many laws.
* On single-step physics problems, Gemini flash image hit 89% average. That dropped to 60% on multi-step chain questions (where you solve one law and feed the result into another), but that's still the best of any model tested.
* Where Gemini struggled: Bernoulli's Equation (worst law), Force to Kinetic Energy chain (0%), and Spring to Speed chain (20%). These are mostly multi-step reasoning problems with unit traps baked in.
* Flash Lite also performed well at 72.9%, beating both Claude models. For a lighter model, that's a strong result.
* Both Gemini models handled the anchoring bias traps well -- questions where a fake "colleague's answer" is embedded to mislead the model. Claude and GPT fell for these more often.

For context, the v0.5 leaderboard with 21 models has Gemini 3.1 flash image at #1 and flash lite at #2 as well, so it's consistent across runs.

The whole thing is open source if anyone wants to run it themselves or look at the per-law breakdowns:

* GitHub: [github.com/agodianel/lawbreaker](https://github.com/agodianel/lawbreaker)
* Full results: [huggingface.co/datasets/diago01/llm-physics-law-breaker](https://huggingface.co/datasets/diago01/llm-physics-law-breaker)

# 80,000 NOK ($7,500) drained from my Google Cloud account in 5 minutes — full forensic breakdown of how the attack worked

I want to write this up while it's fresh, because the *mechanism* of the attack is more interesting than the "I leaked a key, oops" headline — and the platform design that allowed it is something every Google Cloud user should know about.

# What happened

* May 8, 2026, evening (CET): I get a billing alert email saying I owe NOK 82,305.36 (\~$7,500 USD) on my Google Cloud account.
* My typical monthly spend: \~100 NOK ($10).
* The spike happened in roughly 5 minutes.
* All charges were on the Gemini API in a single project I'd barely touched (an old "no-code maps" project from 2017).
* An API key from that project was leaked somewhere — I'm still hunting where. Most likely an old GitHub repo or a public webpage from 2018-ish that had Gemini API enabled on its project years later (I think this is what made it exploitable — the key sat dormant, but the moment Gemini got enabled on its project, the dormant key became a Gemini-capable wallet).

# What the attacker actually did (the part nobody talks about)

I pulled the SKU-level breakdown from Billing → Reports. The attacker didn't just hit one model. They ran an automated framework that fanned out across every Gemini variant simultaneously:

* Gemini 3 Pro (text + image generation)
* Gemini 3 Flash
* Gemini 3.1 Flash Image
* Gemini 3.1 Flash Lite Preview
* Gemini 2.5 Pro (text + TTS)
* Gemini 2.5 Flash (short + long context, multimodal)
* Gemini 2.5 Flash Lite
* Gemini 2.0 Flash TTS
* Gemini Embedding-2 + Embedding-001

15+ distinct models in 5 minutes. No human application uses 15 models in parallel. This is the signature of an automated abuse framework, almost certainly a credential-resale operation.

Token volumes:

* 1.09 BILLION input tokens on Gemini 2.5 Flash Lite alone
* 402M image input tokens on Gemini 3 Pro
* 226M text input tokens on Gemini 3 Pro
* 19.4M image output tokens on Gemini 3 Pro Image — kr 21,674 ($2,000) on this single SKU, the most expensive line item

The attacker prioritized image generation because that's where the real money is — image output tokens are 50–100x more expensive than text.

# How they bypassed rate limits (this is the architectural problem)

You'd think rate limits would protect you. They don't — at least not on Google Cloud:

* Gemini 3 Pro: 1,000 RPM
* Gemini 3 Flash: 2,000 RPM
* Gemini 2.5 Flash Lite: 4,000 RPM
* (etc., for every model — *each with its own independent quota*)

There is no per-key aggregate cap across models. If you fan out across 15 models concurrently, you cap at the *sum* — easily 30,000+ RPM combined.

OpenAI, Anthropic, and Mistral all have per-key aggregate caps. Google does not. This is not a policy oversight — it's the core mechanism that makes a single compromised key a 5-minute, 5-figure liability.

Also: Google Cloud does not offer a hard spending cap. No "stop all spend at $X" option. The closest is a budget alert that *emails you* (after the fact), or — and this is the documented "solution" — you can write your own Cloud Function that listens to budget Pub/Sub events and programmatically disables your billing account. Yes, Google's official answer to "how do I stop runaway spending" is "deploy code on the same platform that's billing you." This has been a known gripe for years.

# What logging gave me — almost nothing

I tried every audit log query:

* `protoPayload.serviceName="generativelanguage.googleapis.com"` → empty
* `resource.type="consumed_api"` for the project → empty
* Vertex AI logs → empty

Google does not log per-request data for Gemini API key calls. No caller IP, no user-agent, no request size. The only forensic record that exists is the SKU-level billing report — and that only goes down to "model + token type", not session/request/key.

So I can't tell you who did it, where they were, or what they generated. I just know it was 15 models in parallel and 19M image output tokens.

# What I did in the first 90 minutes

* Deleted all 13 API keys on the affected project (after seeing the alert at \~01:25)
* Disabled [`generativelanguage.googleapis.com`](http://generativelanguage.googleapis.com) and [`aiplatform.googleapis.com`](http://aiplatform.googleapis.com) on every one of my 25+ projects (script via `gcloud services disable`)
* Closed all 3 billing accounts
* Called my bank, blocked the Visa
* Got into Google's billing chat queue, escalated to specialist team within 5 messages
* Case 71021804 opened, 24-48h response window
* Pulled SKU-level forensic evidence

The chat agent confirmed end-of-month billing cycle, so the actual charge attempt won't fire until \~May 28-31. By then either the specialist team has waived it, or the card-block + chargeback dispute kicks in.

# What I'm pretty sure happens next

* \~85% chance: specialist team waives the charge under the compromised-credentials policy. Google has standardized this for exactly this scenario because they know the rate-limit architecture allows it.
* \~10% chance: partial waiver / settlement.
* \~5% chance: they refuse, my bank chargeback wins it under Norwegian Finansavtaleloven (450 NOK max liability for unauthorized card use).

I'm not actually going to pay 80k. The realistic worst case is several months of paperwork.

# Lessons / PSA for everyone running Google Cloud

1. Restrict every API key at creation time. Application restriction (HTTP referrer or IP allowlist) + API restriction (only the APIs you use). An unrestricted key on a project where Gemini happens to be enabled is a wallet.
2. Audit every project for keys you've forgotten about. I had keys from 2017, 2020, 2021 — most predating Gemini's existence. The moment Gemini got enabled on those old projects, the old keys could call it.
3. Disable APIs you don't actively use. Per-project. An enabled API + an unrestricted key = exposure.
4. Set up a budget-disables-billing Cloud Function. The auto-shutdown one. Yes it's stupid that Google makes you write code for this, but it's the only real circuit breaker.
5. Don't trust rate limits. They protect Google's infrastructure, not your wallet. Per-model RPM × N models = no real cap.
6. Don't store API keys in client-side code, ever. Even if you think a project is dead.

# Where the leak came from

Honestly, I don't know yet. The project was created in 2017 (back when Google appended a numeric suffix like `-364317` to project IDs). It had 13 keys accumulated over years. One of them is somewhere out in the wild. I'll be searching GitHub history, old Vercel deployments, Wayback Machine, and screenshots over the coming days. If I find it I'll edit this post.

If anyone has run into the same multi-model abuse pattern recently, I'd love to hear about it — particularly if you have any signals on which credential-resale operations are currently active.

Edit: Will update with specialist team's response when it arrives in 24-48h.

OpenClaw is now available in the UGOS Pro App Center as a one-click install on supported UGREEN NASync models. If you've been waiting for a local AI agent that lives on your NAS instead of your laptop, it's ready. 

# Overview

**OpenClaw** is a personal AI assistant that runs locally on your device. It interacts with users through common communication channels. The UGREEN NAS version has been deeply customized to provide a "**one-click**" installation experience, enabling a fully no-code deployment workflow.

This guide walks you through installing OpenClaw on your NAS, completing the path and API configuration, and verifying your first connection.

**Note**: This application consumes significant system resources. Ensure your system has at least **2 GB** of available RAM. The installation process may take more than **10 minutes**, which is normal.

# Supported Models

The following NAS models currently support the OpenClaw application (more models are being added):

● DXP Series: DXP2800, DXP4800, DXP4800 Plus, DXP4800 Pro, DXP6800, DXP6800 Plus, DXP6800 Pro, DXP8800, DXP8800 Plus, DXP8800 Pro, DXP480T Plus

● iDX Series: iDX6011, iDX6011 Pro *(support ready; devices currently shipping to crowdfunding backers and not yet generally available)*

# Prerequisites

Before installing OpenClaw, go to the "**App Center**" on your UGREEN NAS and make sure that the **Docker** application is installed and updated to the latest version.

**Note**: OpenClaw relies heavily on the Docker container environment. If the Docker version is outdated, it may cause deployment failures, incorrect permission configurations, or runtime issues.

# Step 1: Install the Application

Log in to your UGREEN NAS, go to the "**App Center**", find **OpenClaw** under the "**All**" list, and click "**Install**".

https://preview.redd.it/pwm42yn1qi0h1.png?width=1112&format=png&auto=webp&s=cc2e4ddb3212210bce8c386140ffa27775ecff73

# Step 2: Installation and Configuration

When installing the OpenClaw application, you must first complete the system path and model interface settings on the "**OpenClaw installation configuration**" page.

# Path Configuration

This section defines the file access scope for OpenClaw. For data security, grant permissions carefully.

https://preview.redd.it/mlbrobc4qi0h1.png?width=591&format=png&auto=webp&s=8f78a6597688186f0f5ed436e2f23016c64a9b6b

* **Workspace path**: This is the default working directory for OpenClaw. It is used by AI to write code, generating files, and storing temporary data. It is recommended to assign an empty folder.
* **File access path**: Authorizes OpenClaw to read or modify existing files on the NAS (such as documents and videos). Multiple directories can be configured by clicking the "**Add**" button.

**Notes:**

* Do not select folders containing private or sensitive data. Deleting, modifying, or moving authorized folders may cause application malfunctions.
* The file access path must not overlap with the "**Workspace path**" or any of its subdirectories.

# API and Model Configuration

This section is used to connect to external large language model (LLM) services.

* **API Base URL**: Enter the interface address provided by the LLM service provider (e.g., `https://generativelanguage.googleapis.com/v1/models/gemini-3.1-flash-lite-preview:generateContent`).
* **Model name**: Enter the specific model version to be invoked (e.g., `gemini-3.1-flash-lite-preview`).
* **API key**: Enter the dedicated access key obtained from the model provider.
* **Gateway token**: This token is required for authentication when accessing the OpenClaw Web interface via a browser.

https://preview.redd.it/zt6y5kk7qi0h1.png?width=597&format=png&auto=webp&s=6293e7c86aa56b6f8004f9517c6688a9645bf738

# Complete the Installation

After confirming that the above configurations are correct and fully understanding the associated risks, select "**I have read and understand and the installation risks**" in the lower-left corner of the page. Then click "**Install**" in the lower-right corner to begin deploying the application.

https://preview.redd.it/hxyc9s79qi0h1.png?width=598&format=png&auto=webp&s=660eceda1aedc64ae59e6cf95e7bbea6a82433cc

# Risks and Precautions

OpenClaw is a highly privileged automation agent. Before installation, please carefully review the following key risks:

1. By default, the application runs within a Docker container with root privileges, allowing it to read and write files and execute system commands. It is strongly recommended not to expose this application to the public internet.
2. The current version does not provide secure multi-user isolation. If multiple users share the same application instance, they will share all tool permissions and data.
3. This open-source project is currently in the testing stage. Any legal, financial, or data-related risks arising from AI-driven automation—such as accidental file deletion or data leakage—shall be borne solely by the user.

# Usage and Connection

After installation, you need to verify the connection through the Web interface. The frontend console must connect to the OpenClaw backend gateway. 

# Step 1: Access the Web Management Interface

1. On the UGREEN NAS desktop, locate the OpenClaw app and click its shortcut icon.
2. The system will automatically open your browser and navigate to the OpenClaw Web management interface.
3. After entering the interface, you will be prompted to **enter the Gateway Token**. Input the token you previously set.
4. Once entered, click the "**Connect**" button below.

https://preview.redd.it/z47ehn5bqi0h1.png?width=1083&format=png&auto=webp&s=f710177d8a5c12ac9d2719c10a214826bd1cd70c

# Step 2: Verify Connection Status

After a successful connection, you can confirm that the gateway is active through the interface:

* Click "**Overview**" in the left sidebar.
* Locate the "**Snapshot**" card on the right side.

Its status should display as green "**OK**"

https://preview.redd.it/pjfnxx5fqi0h1.png?width=1914&format=png&auto=webp&s=0a4dfbddf03ce237481612f22f55195bec0e106e

# Step 3: Start Using the AI Assistant

Click "Chat" in the left sidebar, type your question or command in the input box at the bottom, and click Send (paper plane icon).

If the model you configured in Step 2 is reachable, you'll get a response. If you see a provider error instead, the most common cause is a misconfigured API Base URL, Model name, or API key. You can adjust these from the OpenClaw web UI.

# Common LLM API Configuration

When configuring external large language models for your application, you need to provide the correct API endpoint (URL) and model ID. Below are reference configurations for commonly used models.

# OpenAI (GPT Series)

When configuring the OpenAI API, choose either the base URL or the full request URL based on your application’s requirements:

* Base URL:

​

https://api.openai.com/v1

* Full Request URL (Chat Completions):

​

https://api.openai.com/v1/chat/completions

# Google Gemini

When configuring the Google Gemini API, the request URL must be constructed by combining the base template with a specific model ID.

1. API Endpoint Template Replace `{model}` with the actual model ID you want to use:`https://generativelanguage.googleapis.com/v1/models/{model}:generateContent`
2. Example of a Complete Endpoint For example, using `gemini-3.1-flash-lite-preview`:`https://generativelanguage.googleapis.com/v1/models/gemini-3.1-flash-lite-preview:generateContent`
3. Available Gemini 3 Series Model IDs

Select a model based on your token quota and task requirements:

* `gemini-3.1-flash-lite-preview`
* `gemini-3.1-flash-image-preview`
* `gemini-3.1-pro-preview`
* `gemini-3-flash-preview`
* `gemini-3-pro-image-preview`

# Security Risk Notice

* **Root Privileges and High-Risk Operations**: This application runs with **root privileges** inside a Docker container to support automation tasks. It can read/write/delete files, publish external messages, and execute system commands. **Only grant access to trusted directories and avoid mounting sensitive data paths**.
* **No Multi-Tenant Isolation**: By default, OpenClaw is designed for a single trusted user. It does not provide multi-user isolation. If shared, all users will have the same permissions.
* **Public Network Exposure Risks**: Do not expose the service to the public internet unless you are familiar with security hardening and access control. **UGREEN NAS does not provide guidance for public deployment**—consult professionals if needed.
* **Content Compliance**: When interacting externally (e.g., via messaging bots), ensure compliance with platform policies and local laws. Users are responsible for all AI-generated content.
* **Disclaimer**: This application is provided solely as a service integration tool. The provider offers deployment support only and makes no guarantees regarding the security, stability, or functional completeness of the OpenClaw software itself. Any customization, configuration choices, or operational decisions made by the user—and all resulting legal, financial, or data-related risks (including but not limited to data breaches, device damage, cost overruns, or legal disputes)—are the sole responsibility of the user. The provider assumes no liability.