Public Google API keys can be used to expose Gemini AI data

Researchers discovered that many Google Cloud API keys previously considered safe to publish can now be used as credentials for Gemini, with roughly 2,800 live public keys identified (including keys from major firms and Google). This change can let attackers access AI endpoints (potentially reaching data in Docs, Drive, Calendar, etc.) or exhaust cloud billing; the report urges auditing projects for the Generative Language API, checking key restrictions, rotating exposed keys, and monitoring billing and integrations.