Back Cybersecuritynews

Google API Keys Expose Private Data Silently Through Gemini

Cybersecuritynews •Guru Baran • February 27, 2026

A critical privilege escalation vulnerability affecting Google Cloud API keys specifically how legacy public-facing keys now silently grant unauthorized access to Google’s Gemini AI endpoints, exposing private files, cached data, and billable AI usage to attackers. For over a decade, Google explicitly instructed developers to embed API keys formatted as AIza... strings directly into client-side […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Old Google API Keys Expose Sensitive Data via Gemini Access Old Google API keys, previously deemed harmless, now pose a security risk as they can access sensitive data through the Gemini API. Security researchers found that nearly 3,000 keys, originally used for public services, can authenticate to Gemini, allowing potential attackers to access private data. This shift in functionality has raised alarms among developers and security experts. 12 sources 29

Extracted Entities

Google API Keys Expose Private Data Silently Through Gemini

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Tools (2)