Deleted Google API Keys Continue Accessing Gemini, BigQuery, and Maps APIs

Cybersecuritynews •Abinaya • May 22, 2026

A newly disclosed issue with Google Cloud API keys reveals that deleted credentials may remain usable for up to 23 minutes, exposing projects to potential abuse even after revocation. The finding raises concerns delayed credential invalidation across Google’s infrastructure, particularly for sensitive services such as Gemini, BigQuery, and Google Maps APIs. According to Aikido […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Google API Keys Remain Active for Up to 23 Minutes After Deletion Research by Aikido Security reveals that Google API keys can remain active for up to 23 minutes post-deletion, contrary to user expectations of immediate revocation. This delay allows attackers with leaked keys to continue accessing sensitive services, including Gemini, during this window. Aikido's tests showed a median revocation window of around 16 minutes, with significant variability based on server location. The findings highlight a critical vulnerability in Google's infrastructure, as attackers can exploit this delay to run up charges or exfiltrate sensitive data. Google has not provided a fix for this issue, which poses a serious risk to organizations relying on API keys for access control. The problem is compounded by Google's billing policies that can lead to unexpected charges for users. This situation mirrors a previously reported issue with AWS access keys, where a four-second window allowed for similar exploitation. 7 sources 66

Deleted Google API Keys Continue Accessing Gemini, BigQuery, and Maps APIs

The full story

Extracted Entities

Platforms (2)

Tools (2)