Darkreading Google API Keys Remain Active for Up to 23 Minutes After Deletion
Article Content
- •Google API keys can remain valid for up to 23 minutes after deletion.
- •Attackers can exploit this delay to access sensitive data and incur unexpected charges.
- •Google has not addressed this vulnerability, leaving users at risk.
Research by Aikido Security reveals that Google API keys can remain active for up to 23 minutes post-deletion, contrary to user expectations of immediate revocation. This delay allows attackers with leaked keys to continue accessing sensitive services, including Gemini, during this window. Aikido's tests showed a median revocation window of around 16 minutes, with significant variability based on server location. The findings highlight a critical vulnerability in Google's infrastructure, as attackers can exploit this delay to run up charges or exfiltrate sensitive data. Google has not provided a fix for this issue, which poses a serious risk to organizations relying on API keys for access control. The problem is compounded by Google's billing policies that can lead to unexpected charges for users. This situation mirrors a previously reported issue with AWS access keys, where a four-second window allowed for similar exploitation.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (7)
Following this threat?
Track AWS in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…