{"schema_version":"0.10.0","id":"LR-2026-0422","record_version":1,"title":"Previously harmless Google API keys expose Gemini AI data","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":58.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":3.52,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"2 independent outlets","original_document":null,"reports_total":2,"reports_independent":2,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"2 independent outlets"}]},"sources_hash":"a86d19b80a041870c80a234aa1326d70299b4c4eb562dc3d432d93f8b61679fc"},"system":{"model_name":"Gemini","model_version":null,"developer":"Google","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-02-26","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"credential_exposure","duration":null,"detection_method":"third_party","summary":"Google API keys that developers had embedded in public client-side code, for services such as Maps, could be used to authenticate to the Gemini AI assistant and reach private data after Google introduced Gemini. Researchers at TruffleSecurity found more than 2,800 live keys in the November 2025 Common Crawl dataset and warned that attackers could copy keys from page source and call the Gemini API. CloudSEK later identified 32 exposed keys across 22 Android applications. One developer reported that an attacker used a public key to flood Gemini with requests, and charges reached $15,400 before the key was revoked. Researchers confirmed that user audio files were reachable in one app. Google said it had classified the flaw as single-service privilege escalation and that new keys would default to Gemini-only scope, with leaked keys blocked from Gemini.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Test: many third parties with a stated count of two or more affected parties. Fact: 22 Android applications with a combined install base exceeding 500 million users were affected.","harm_class":[],"affected_description":"32 exposed Google API keys across 22 Android applications with a combined install base exceeding 500 million users","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.bleepingcomputer.com/news/security/previously-harmless-google-api-keys-now-expose-gemini-ai-data/","publisher":"BleepingComputer","date":"2026-02-26","type":"press","title":"Previously harmless Google API keys now expose Gemini AI data - BleepingComputer","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.techradar.com/pro/security/usd15k-bill-destroyed-a-solo-developers-startup-how-hackers-are-using-leaked-google-api-keys-to-go-wild-with-gemini-ai-for-free","publisher":"TechRadar","date":"2026-04-11","type":"press","title":"Google API keys give attackers unauthorized Gemini AI access - TechRadar","archived_url":null,"independence":"independent"}],"per_field_confidence":{"system.developer":"C","system.model_name":"C","event.trigger":"C","event.detection_method":"C","impact.affected_description":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"When Gemini was introduced, Google Cloud API keys also acted as authentication credentials for Google's AI assistant."}],"system.model_name":[{"source_index":0,"quote":"Google API keys for services like Maps embedded in accessible client-side code could be used to authenticate to the Gemini AI assistant and access private data."}],"event.trigger":[{"source_index":0,"quote":"Google API keys for services like Maps embedded in accessible client-side code could be used to authenticate to the Gemini AI assistant and access private data."}],"event.detection_method":[{"source_index":0,"quote":"Researchers at TruffleSecurity discovered the issue and warned that attackers could copy the API key from a website's page source and access private data available through the Gemini API service."}],"impact.affected_description":[{"source_index":1,"quote":"CloudSEK’s research identified 32 exposed Google API keys across 22 Android applications with a combined install base exceeding 500 million users."}],"event.incident_class":[{"source_index":0,"quote":"Researchers at TruffleSecurity discovered the issue and warned that attackers could copy the API key from a website's page source and access private data available through the Gemini API service."}],"impact.severity":[{"source_index":1,"quote":"CloudSEK’s research identified 32 exposed Google API keys across 22 Android applications with a combined install base exceeding 500 million users."}],"impact.severity_because":[{"source_index":1,"quote":"CloudSEK’s research identified 32 exposed Google API keys across 22 Android applications with a combined install base exceeding 500 million users."}],"event.summary":[{"source_index":0,"quote":"Google API keys for services like Maps embedded in accessible client-side code could be used to authenticate to the Gemini AI assistant and access private data."},{"source_index":0,"quote":"Researchers at TruffleSecurity discovered the issue and warned that attackers could copy the API key from a website's page source and access private data available through the Gemini API service."},{"source_index":0,"quote":"TruffleSecurity scanned the November 2025 Common Crawl dataset, a representative snapshot of a large swath of the most popular sites, and found more than 2,800 live Google API keys publicly exposed in their code."},{"source_index":1,"quote":"CloudSEK’s research identified 32 exposed Google API keys across 22 Android applications with a combined install base exceeding 500 million users."},{"source_index":1,"quote":"The developer revoked the key within minutes of receiving a billing alert, yet due to a reporting lag in Google Cloud’s billing system, the charges had already reached $15,400."},{"source_index":1,"quote":"Researchers confirmed data exposure in ELSA Speak when they accessed user-submitted audio files via the Gemini Files API."},{"source_index":0,"quote":"Google stated that new AI Studio keys will default to Gemini-only scope, leaked API keys will be blocked from accessing Gemini, and proactive notifications will be sent when leaks are detected."}]},"notes_on_gaps":"No autonomous agent is described, so agent_involved, failure_class and autonomy fields are left out. The date of occurrence, the date of detection and the date of public disclosure are not stated in the text, so they are left out. The sources give separate loss figures for different developers ($15,400, $128,000, $82,314) and no total, so direct_loss_usd is left out. No record count is stated. The 'last year' in the Google reporting sentence is taken as 2025 from the article date of 2026-02-26; this is a judgement. Privacy harm rests on the ELSA Speak sentence and financial harm on the developer billing case, which is quoted in the timeline and summary. The root cause is categorised as integration, a judgement from the CloudSEK finding. The Google outcome for control A1 is a judgement drawn from the TruffleSecurity warning about excess privileges. The TruffleHog and key-audit advice is a recommendation, not a stated change. Country and industry are not stated and are left out. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (2 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Google API keys used for public services such as Maps were embedded in client-side code, where they could also authenticate to the Gemini assistant.","quote":"Google API keys for services like Maps embedded in accessible client-side code could be used to authenticate to the Gemini AI assistant and access private data.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"When Gemini was introduced, these keys also became authentication credentials for the AI assistant, so public keys gained more privilege.","quote":"When Gemini was introduced, Google Cloud API keys also acted as authentication credentials for Google's AI assistant.","source_index":0,"grade":"C"},{"step":"done","text":"Google said new AI Studio keys would default to Gemini-only scope, leaked keys would be blocked from Gemini, and leak notifications would be sent.","quote":"Google stated that new AI Studio keys will default to Gemini-only scope, leaked API keys will be blocked from accessing Gemini, and proactive notifications will be sent when leaks are detected.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.bleepingcomputer.com/news/security/previously-harmless-google-api-keys-now-expose-gemini-ai-data/","https://www.techradar.com/pro/security/usd15k-bill-destroyed-a-solo-developers-startup-how-hackers-are-using-leaked-google-api-keys-to-go-wild-with-gemini-ai-for-free"]},"analysis":{"sections":{"timeline":[{"text":"An API key was deployed and embedded in a Google product's public website page source.","quote":"In one case, an API key acting just as an identifier was deployed since at least February 2023 and was embedded in the page source of a Google product's public-facing website.","source_index":0,"when":"February 2023"},{"text":"TruffleSecurity scanned the Common Crawl dataset and found more than 2,800 live exposed Google API keys.","quote":"TruffleSecurity scanned the November 2025 Common Crawl dataset, a representative snapshot of a large swath of the most popular sites, and found more than 2,800 live Google API keys publicly exposed in their code.","source_index":0,"when":"November 2025"},{"text":"Google classified the flaw as single-service privilege escalation.","quote":"After a long exchange, Google classified the flaw as “single-service privilege escalation” on January 13, 2026.","source_index":0,"when":"2026-01-13"},{"text":"Google stated its planned changes to key scope, blocking and notifications.","quote":"Google stated that new AI Studio keys will default to Gemini-only scope, leaked API keys will be blocked from accessing Gemini, and proactive notifications will be sent when leaks are detected.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.bleepingcomputer.com/news/security/previously-harmless-google-api-keys-now-expose-gemini-ai-data/","https://www.techradar.com/pro/security/usd15k-bill-destroyed-a-solo-developers-startup-how-hackers-are-using-leaked-google-api-keys-to-go-wild-with-gemini-ai-for-free"]}}