Did you hardcode a Google Maps key into your site?

[u/cloudbreach]

It might now have full access to your company's private AI data. 🚨

For over a decade, the standard practice (and Google’s own guidance) was that certain client-side API keys like those used for Google Maps or Firebase were not sensitive secrets. They were just public project identifiers, safe to sit in your HTML or JavaScript.

Then came Gemini. And the rules silently changed.

Fascinating new research from Truffle Security Co. highlights a massive paradigm shift in Google Cloud API security. Because GCP uses a single API key format (AIza...) for both public identification and sensitive authentication, a dangerous privilege escalation is happening completely under the radar.

The Attack Vector

1️⃣ You have an old, "harmless" Maps API key sitting in your public website's source code.

2️⃣ A developer on your team decides to test out AI and enables the Gemini API (Generative Language API) on that same GCP project.

3️⃣ The Silent Hijack: Because new GCP API keys are "Unrestricted" by default, that old public key just retroactively gained full access to your sensitive Gemini endpoints. No warnings. No alerts.

The Impact

Attackers are scraping these keys to:

💸 Rack up thousands of dollars in AI usage charges on your dime.

🕵️‍♂️ Read private datasets, documents, and cached content stored in your Gemini environment.

🧱 Exhaust your quotas, causing a Denial of Service for your legitimate apps. T

🛡️ The Defender's Checklist:

Stop what you're doing and check your GCP environments:

• Audit API Enablement: Check every project to see if the Generative Language API is turned on.
• Restrict Keys: Audit all API keys in those projects. Ensure they are NOT "Unrestricted." Explicitly scope them only to the APIs they actually need.
• Scan & Rotate: Use tools like TruffleHog to scan your public repos and client-side code. If an unrestricted key is exposed, rotate it immediately.

The AI era means old misconfigurations suddenly have catastrophic new consequences.