Researchers at Truffle Security found that about 3,000 exposed Google Cloud API keys granted unauthorized access to Gemini AI services. This vulnerability results from a “privilege escalation” side effect. When the Gemini API is enabled for a Google Cloud project, each unrestricted key in that project automatically gets full access to Gemini without the developer’s knowledge.

Key Risks

• Data exposure: Attackers can potentially access private files, cached datasets, and documents uploaded to the Gemini platform.
• Financial impact: Leaked keys can lead to large bills because Gemini usage is metered. One developer reported over $82,000 in fraudulent charges in 48 hours.
• Widespread vulnerability: Vulnerable keys were identified across major banks, security firms, and Google’s own public-facing sites [trufflesecurity.com].

How to Secure Your Project

1. Audit enabled APIs: Visit the Google Cloud Console [console.cloud.google.com] to see if the Generative Language API is active.
2. Restrict Keys: Go to APIs & Services > Credentials [console.cloud.google.com]. Edit your keys to add API restrictions. Make sure the keys only work for specific services, like Google Maps, and cannot be used for Gemini.
3. Rotate Leaked Keys: If a key has been committed to a public repository, revoke and replace it immediately.
4. Automated Scanning: Use tools like TruffleHog [github.com] to scan your codebases for exposed secrets that might have active AI permissions.

Google is working on a fix to prevent unrestricted keys from automatically gaining access to sensitive AI services by default.