‘Silent’ Google API key change exposed Gemini AI data
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Google Cloud Platform API keys, historically used only for billing identification, silently became authentication credentials for the Gemini AI API starting in late 2023 — without notifying developers. Researchers at Truffle Security found 2,863 live exposed keys via a Common Crawl scan, affecting major financial institutions, security firms, and even Google itself. Attackers could use these public keys to access private Gemini data (uploaded files, cached content, datasets) or exhaust API quotas, generating large bills. Google initially dismissed the report as intended behavior but later acknowledged it as a bug and restricted the exposed keys. Mitigation involves checking the GCP console for unrestricted or Generative Language API-enabled keys and rotating any that are public. Google has since updated its roadmap to default new AI Studio keys to Gemini-only access and plans to block leaked keys.
