Cloud · 244 days ago

Exposed Google API Keys allow Gemini access, billing abuse

Truffle Security found 2,863 public Google Cloud API keys embedded in client-side code that gain access to Gemini after the Generative Language API is enabled.

Timeline

• Feb 28 Reported by The Hacker News
• Feb 27 Reported by CSO Online
• Feb 26 Reported by BleepingComputer

Sources

3 sources covering this story

• The Hacker News Feb 28

  Thousands of Public Google Cloud API Keys Exposed with Gemini Access After API Enablement

  Research reveals 2,863 public Google API keys can access Gemini endpoints, enabling data exposure and massive billing abuse.

• CSO Online Feb 27

  ‘Silent’ Google API key change exposed Gemini AI data

  Billing ID keys were turned into Gemini authentication credentials without informing developers.

• BleepingComputer Feb 26

  Previously harmless Google API keys now expose Gemini AI data

  Google API keys for services like Maps embedded in accessible client-side code could be used to authenticate to the Gemini AI assistant and access private data.

Part of the PlainSec briefing for 2026-03-01

Editions

• Briefing for 2026-03-01