[saalweachter]

Two kinds of oauth tokens at play here.

Tokens like those generated by the gemini CLI, accounted to the user and metered so you're charged every million or so tokens.

Tokens like those internal to the Antigravity app, accounted to the product (which is why this was noticed -- the resources allotted to the app were being exhausted) and not metered per token (which is why everyone was trying to use them for everything).

As the other commenter said, the first person to do this definitely knew what they were doing. All the script kiddies who piled on after, probably not, but that's also part of why "script kiddy" is a derogatory term. Not only do they usually not understand the scripts they run, they also typically do not understand the risks associated with them.