Joe LeonAuthor of Truffle Security's post on Gemini and Google API keysTruffle Security
Security research on Google API keys published in the November 2025 Common Crawl.
Its own announcement, published Read the report (opens the announcement in a new tab)
Observation
Truffle Security found 2,863 live Google API keys that had silently gained Gemini access when the Generative Language API was turned on in their projects.
- Takeaway
- Audit every existing API key in a project before enabling Gemini on it, restrict each key to named APIs, and set a project spend cap.
- What happened
- Google API keys created years earlier for Maps or Firebase were treated as public. When a project enabled the Generative Language API, those keys could call Gemini, read uploaded files and cached content, and bill usage to the owner. Truffle Security found 2,863 such live keys, including keys of financial institutions, security firms and Google itself (Truffle Security, Feb 25, 2026).
“We identified 2,863 live Google API keys vulnerable to this privilege-escalation vector.”
- Public organization write-up (independent security research)
- Count of exposed keys measured
Deployment details
Security research on Google API keys published in the November 2025 Common Crawl.
- Public organization write-up (independent security research)
- Count of exposed keys measured
- Team
- Truffle Security research
- Workload
- Scan of the November 2025 Common Crawl for live Google API keys
- Product version
- Gemini API through the Generative Language API
- Measurement
- 2,863 live keys exposed (Feb 25, 2026)









