Thousands of Public Google Cloud API Keys Exposed with Gemini Access After API Enablement

New research from Truffle Security (and corroborating findings from Quokka) shows thousands of Google Cloud API keys embedded in client-side code and mobile apps can be abused to access Gemini/Generative Language API endpoints when that API is enabled on a project; attackers scraping public sites or repos can use those keys to access uploaded or cached contents and run LLM calls that incur large charges. The default creation of "Unrestricted" keys and retroactive granting of Gemini privileges amplified exposure; Google has implemented mitigations to detect and block leaked keys, and users are advised to audit enabled AI APIs and rotate exposed keys.