Previously harmless Google API keys now expose Gemini AI data

Researchers at TruffleSecurity found nearly 2,800 publicly exposed Google API keys embedded in client-side code that, due to changes when Google introduced the Gemini AI assistant, can be used to authenticate to Gemini and access private data or generate costly API usage; Google has been notified and implemented mitigations to block leaked keys and change default key scopes.