Google API Keys Quietly Gain Access to Gemini on Android Devices

A CloudSEK advisory reports that Google's long-standing public API key format can silently gain access to Gemini AI endpoints when Gemini is enabled in a project, exposing embedded keys in Android apps and allowing unauthorized access to user data, unexpected charges, and service disruption. Analysis of 10,000 apps found 32 active keys across 22 applications (collectively >500 million installs), with demonstrated access to user-uploaded audio files and reported financial losses up to $128,000; researchers advise auditing, rotating keys, and restricting API access.