Google API Keys Weren't Secrets. But then Gemini Changed the Rules.

2026-02-26 · Source: Simon Willison's Weblog · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Software Development & Engineering · Depth: Intermediate, quick

Summary

Google's Gemini API and Google Maps API share the same API key infrastructure, leading to a critical security vulnerability. Historically, Google Maps API keys were designed for public embedding in web pages and were considered harmless. However, enabling the Gemini API on a project automatically grants these same public keys access to sensitive Gemini endpoints, which can access private files and incur billing charges. This constitutes a privilege escalation, as developers are not warned when their previously public API keys gain secret credential capabilities. Truffle Security identified 2,863 such vulnerable API keys in the November 2025 Common Crawl, including some belonging to Google, with one key active since February 2023, predating Gemini's API.

Key takeaway

For security teams and developers managing Google Cloud projects, you must immediately audit your existing Google API keys. Verify that no publicly exposed keys, especially those used for Google Maps or similar services, have inadvertently gained access to sensitive Gemini API endpoints. This change in key privilege, occurring without explicit warning, necessitates proactive revocation of any affected keys to prevent unauthorized data access and unexpected billing.

Key insights

Shared API key infrastructure between public and private services creates critical privilege escalation risks.

Principles

• API keys should follow least privilege.
• Privilege changes require explicit notification.

In practice

• Audit existing Google API keys.
• Verify Gemini API access for public keys.

Topics

• API Security
• Privilege Escalation
• Google Gemini
• API Keys
• Common Crawl

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Security Engineer, Security Engineer, Software Engineer

Related on AIssential

• Gemini API Key Security: How Developers Should Lock Down AI Credentials Before They Break… — AI credentials carry a larger blast radius than older API keys, necessitating a shift from old key habits to robust security practices.
• 😺 Google Gemini got hijacked via WhatsApp — AI assistants reading external notifications create a broad attack surface for indirect prompt injection, bypassing current defenses.
• Take Control: Customer-Managed Keys for Lakebase Postgres — Lakebase CMK offers comprehensive, customer-controlled encryption for both storage and ephemeral compute via hierarchical Envelope Encryption.
• Why Did Vercel Get Breached? What We Know About the April 2026 Attack — Third-party OAuth credential theft is a prevalent attack vector bypassing traditional perimeter defenses and MFA.
• API keys - Mistral AI — Mistral API keys authenticate requests, are Workspace-scoped, and require secure handling and regular management.
• Be Careful - Don't get banned by OpenClaw/Clawdbot use! — Misusing LLM service OAuth for third-party tools can lead to account bans due to terms of service violations and revenue loss.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Simon Willison's Weblog.