Reliable accounting requires understanding whether a value is cumulative, incremental or absent. Summing every reported total can overstate a charge; treating absence as zero can erase evidence of prior work.
What deployment does this concern?
Component and scope: Kong AI Proxy plugin handling of Gemini streaming usage.
Affected versions / scope: The cited release notes describe the fix; no security-advisory affected interval is supplied here.
Vendor remediation: 3.16.0.0 includes the stated fix.
Streaming Gemini responses can repeat running usage metadata or omit metadata in some chunks. The release notes address overcounting repeated cumulative values and resetting usage when metadata is missing.
Vendor response and practical action
The vendor's 3.16.0.0 changelog records the correction. Confirm which AI Proxy plugin is deployed and reproduce the usage pattern with provider-side accounting evidence.
Treat the vendor notice as the starting point for an applicability decision. Identify the installed artifact and configuration, document whether the prerequisite exists, and assign an owner to any required change. A public advisory does not establish that your installation was exposed or that a managed service shares the same condition.
What clients can learn
Use release notes as evaluation evidence without promoting every correction to a CVE. A billing test should include complete streams, disconnected streams, missing final events and retries.
A useful evaluation result connects a named control to evidence from the actual deployment. Keep the provider's statement, your effective configuration and a relevant demonstration together. If the result depends on a feature being disabled or a network being isolated, retain that fact with the version number so a later change triggers review.
Questions to take to your provider
- Is each usage field incremental or cumulative?
- What remains recorded if the client disconnects?
- Which plugin version processes the Gemini response?
- How are gateway measurements compared with the provider bill?
Use the six-page evaluation worksheet to record evidence, ownership and actions. Continue with AI gateway budgets and scaling: measure the whole request for the wider evaluation context.
Technical detail: evidence and identifier limits
This is labelled a release fix. The cited entry does not establish an independent vulnerability or apply automatically to every newer Kong AI offering.
Evidence label: release fix. Source-review date: 2026-10-07. Source publication or event date: 2026-09-15. These dates do not change merely because this article is rebuilt.