Google: Google API keys for Gemini AI pose security risk

Google API Keys Exposed in Client-Side Code Pose New Security Risks

Researchers have uncovered a critical security flaw involving Google API keys embedded in client-side code, exposing organizations including Google itself to potential data breaches and financial losses. Over 2,800 live API keys were found publicly accessible in JavaScript code across various websites, primarily due to their expanded authentication capabilities with Google’s Gemini AI assistant.

Previously, these keys were considered low-risk when used for services like Google Maps or usage tracking. However, their new ability to authenticate users to Gemini’s API has created a significant vulnerability. Attackers can extract exposed keys from a website’s source code and exploit them to access private data or generate excessive API calls, leading to substantial financial charges potentially thousands of dollars per day per compromised account.

Google has acknowledged the issue and taken steps to mitigate risks, including defaulting new API keys to a Gemini-only scope and implementing automated detection to block leaked keys. The company has also begun notifying affected users. Developers are advised to audit and rotate any potentially exposed keys to prevent misuse. The findings highlight the growing risks of hardcoded credentials in client-side applications as API functionalities expand.

Source: https://www.scworld.com/brief/google-api-keys-for-gemini-ai-pose-security-risk

Google cybersecurity rating report: https://www.rankiteo.com/company/google

"id": "GOO1772253234",
"linkid": "google",
"type": "Vulnerability",
"date": "2/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Technology/Software',
                        'name': 'Google',
                        'type': 'Technology Company'},
                       {'name': 'Various organizations using exposed Google '
                                'API keys',
                        'type': 'Organizations'}],
 'attack_vector': 'Exposed API keys in client-side code',
 'data_breach': {'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Private data'},
 'description': 'Researchers have uncovered a critical security flaw involving '
                'Google API keys embedded in client-side code, exposing '
                'organizations including Google itself to potential data '
                'breaches and financial losses. Over 2,800 live API keys were '
                'found publicly accessible in JavaScript code across various '
                'websites, primarily due to their expanded authentication '
                'capabilities with Google’s Gemini AI assistant. Attackers can '
                'extract exposed keys from a website’s source code and exploit '
                'them to access private data or generate excessive API calls, '
                'leading to substantial financial charges.',
 'impact': {'data_compromised': 'Private data',
            'financial_loss': 'Potentially thousands of dollars per day per '
                              'compromised account',
            'systems_affected': 'Websites using exposed Google API keys'},
 'lessons_learned': 'The growing risks of hardcoded credentials in client-side '
                    'applications as API functionalities expand',
 'motivation': 'Financial gain, data access',
 'post_incident_analysis': {'corrective_actions': 'Defaulting new API keys to '
                                                  'a Gemini-only scope, '
                                                  'automated detection to '
                                                  'block leaked keys, '
                                                  'notifying affected users, '
                                                  'advising developers to '
                                                  'audit and rotate exposed '
                                                  'keys',
                            'root_causes': 'Hardcoded Google API keys in '
                                           'client-side code with expanded '
                                           'authentication capabilities'},
 'recommendations': 'Audit and rotate any potentially exposed API keys to '
                    'prevent misuse',
 'response': {'containment_measures': 'Defaulting new API keys to a '
                                      'Gemini-only scope, automated detection '
                                      'to block leaked keys',
              'remediation_measures': 'Notifying affected users, advising '
                                      'developers to audit and rotate exposed '
                                      'keys'},
 'title': 'Google API Keys Exposed in Client-Side Code Pose New Security Risks',
 'type': 'Data Exposure',
 'vulnerability_exploited': 'Hardcoded Google API keys with expanded '
                            'authentication capabilities'}