--- title: ‘Silent’ Google API key change exposed Gemini AI data description: Google Cloud Platform API keys, historically used only for billing identification (prefixed 'Aiza'), silently became authentication credentials for the Gemini... canonical: https://daily.dev/posts/silent-google-api-key-change-exposed-gemini-ai-data-mcx5u1vv0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ‘Silent’ Google API key change exposed Gemini AI data | daily.dev og:description: Google Cloud Platform API keys, historically used only for billing identification (prefixed 'Aiza'), silently became authentication credentials for the Gemini... og:url: https://daily.dev/posts/silent-google-api-key-change-exposed-gemini-ai-data-mcx5u1vv0 og:image: https://api.daily.dev/og/posts/MCX5U1vV0.png og:image:alt: ‘Silent’ Google API key change exposed Gemini AI data og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ‘Silent’ Google API key change exposed Gemini AI data **[InfoWorld](https://daily.dev/sources/infoworld)** · 4 min read · 0 upvotes · 0 comments ## Summary Google Cloud Platform API keys, historically used only for billing identification (prefixed 'Aiza'), silently became authentication credentials for the Gemini AI API from late 2023 onward without notifying developers. Researchers at Truffle Security found 2,863 live exposed keys via a Common Crawl scan, affecting major financial institutions, security firms, and even Google itself. Attackers could extract these public keys from site source code to access private Gemini data—uploaded files, cached content, datasets—or rack up large API bills. Google initially dismissed the report as intended behavior but later acknowledged the bug and restricted the exposed keys from Gemini access. Mitigation steps include auditing GCP console for unrestricted or Generative Language API-enabled keys and rotating any that are public. Google's roadmap now includes defaulting new AI Studio keys to Gemini-only access and blocking detected leaked keys. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Google API Keys Weren't Secrets. But then Gemini Changed the Rules. ◆ Truffle Security Co.](https://daily.dev/posts/google-api-keys-weren-t-secrets-but-then-gemini-changed-the-rules-truffle-security-co--wmqn4ysm3) · Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#gcp](https://daily.dev/tags/gcp), [#google-gemini](https://daily.dev/tags/google-gemini) [View this post on daily.dev](https://daily.dev/posts/silent-google-api-key-change-exposed-gemini-ai-data-mcx5u1vv0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"‘Silent’ Google API key change exposed Gemini AI data","url":"https://daily.dev/posts/silent-google-api-key-change-exposed-gemini-ai-data-mcx5u1vv0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/silent-google-api-key-change-exposed-gemini-ai-data-mcx5u1vv0"},"datePublished":"2026-02-27T20:50:04.842Z","dateModified":"2026-08-24T08:21:15.192Z","description":"Google Cloud Platform API keys, historically used only for billing identification (prefixed 'Aiza'), silently became authentication credentials for the Gemini...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/56cac9ffa72f1916bcb459bce436b0e6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/56cac9ffa72f1916bcb459bce436b0e6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoWorld","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoWorld","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/bf6d68a999064029b0bb09aa6268f1f3","url":"https://daily.dev/sources/infoworld"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/silent-google-api-key-change-exposed-gemini-ai-data-mcx5u1vv0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,gcp,google-gemini","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoWorld","item":"https://daily.dev/sources/infoworld"},{"@type":"ListItem","position":3,"name":"‘Silent’ Google API key change exposed Gemini AI data"}]} ```