AI Risk Wire

Cases › security breach › LR-2026-0422

Previously harmless Google API keys expose Gemini AI data

Confirmed Why: 2 independent outlets · 2 independent reports

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: action reported, no fix

Severity major
Reported 26 Feb 2026
Developer and model Google · Gemini

No source states: loss or records, agent tool, could do, deployer, industry.

Severity major: Test: many third parties with a stated count of two or more affected parties. Fact: 22 Android applications with a combined install base exceeding 500 million users were affected.

Google API keys that developers had embedded in public client-side code, for services such as Maps, could be used to authenticate to the Gemini AI assistant and reach private data after Google introduced Gemini. Researchers at TruffleSecurity found more than 2,800 live keys in the November 2025 Common Crawl dataset and warned that attackers could copy keys from page source and call the Gemini API. CloudSEK later identified 32 exposed keys across 22 Android applications. One developer reported that an attacker used a public key to flood Gemini with requests, and charges reached $15,400 before the key was revoked. Researchers confirmed that user audio files were reachable in one app. Google said it had classified the flaw as single-service privilege escalation and that new keys would default to Gemini-only scope, with leaked keys blocked from Gemini.

What happened

1 · What it was doingGoogle API keys used for public services such as Maps were embedded in client-side code, where they could also authenticate to the Gemini assistant.
2 · What went wrongWhen Gemini was introduced, these keys also became authentication credentials for the AI assistant, so public keys gained more privilege.

What was done

Google said new AI Studio keys would default to Gemini-only scope, leaked keys would be blocked from Gemini, and leak notifications would be sent.

Risks

Credential and privilege abuse
Primary37 incidents
AI used to run a cyber attack
Also96 incidents
Rising: 24 vs 4.0 a week
AI system attacked or breached
Also23 incidents

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Short-lived, scoped credentials · Secrets kept out of the model's context · Separate identity for each agent · Least-privilege access for the agent · Alerts on unusual tool use · Activity logs · Sensitive-data checks on outbound data

Infrastructure / target

Multi-factor sign-in and password policy · Secrets scanning

Similar incidents

Gemini lock-screen flaw lets strangers send messages from locked Android phones2026-07-17
Google Gemini accessed systems of three real companies during a misconfigured third-party cybersecurity evaluation2026-09-19
ICMP evidence that Google Gemini reproduced lyrics by Australian artists2026-10-19
Google Gemini global outage exceeds seven hours2026-06-11

All cases of this kind ›

Evidence

No source states: what it reached or did, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause.

Show the full account: 4 items from the primary sources

What happened, in order

  1. February 2023 An API key was deployed and embedded in a Google product's public website page source.
  2. November 2025 TruffleSecurity scanned the Common Crawl dataset and found more than 2,800 live exposed Google API keys.
  3. 2026-01-13 Google classified the flaw as single-service privilege escalation.

Not dated in the sources:

  • Google stated its planned changes to key scope, blocking and notifications.
Show every field, with its source and grade

The AI system

Model
Gemini
C one secondary source states it
Developer
Google
C one secondary source states it

What happened

Earliest source we hold
2026-02-26
D inferred by us from the described behaviour, reason shown
What set it off
exposed credentials
C one secondary source states it
Who caught it
an outside party
C one secondary source states it
What went wrong
security breach
D inferred by us from the described behaviour, reason shown

Impact

Severity
major
D inferred by us from the described behaviour, reason shown
Who was affected
32 exposed Google API keys across 22 Android applications with a combined install base exceeding 500 million users
C one secondary source states it
Why this severity
Test: many third parties with a stated count of two or more affected parties. Fact: 22 Android applications with a combined install base exceeding 500 million users were affected.
D inferred by us from the described behaviour, reason shown

Notes on gaps

The TruffleHog and key-audit advice is a recommendation, not a stated change.

LR-2026-0422 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON