Google API Keys Leak Sensitive Data Without Warning via Gemini

Security researchers found that legacy public Google API keys—originally safe as public billing identifiers—can be silently upgraded to grant access to Google’s Gemini generative AI when the Generative Language API is enabled on a project, allowing attackers who scrape exposed keys to access private datasets, cached contexts, and execute billable AI queries; organizations are advised to audit projects, rotate exposed keys, and restrict key scope.