Google API Keys Expose Private Data Silently Through Gemini

Truffle Security disclosed that legacy Google Cloud API keys historically embedded in public client-side code can silently inherit access to Gemini (Generative Language) endpoints when that API is enabled, allowing attackers to read uploaded files, cached AI context, and incur billable usage. The researchers found 2,863 live vulnerable keys in a Common Crawl scan, affecting organizations including major firms and Google itself, and recommend immediate auditing, rotation, and remediation of unrestricted keys.