The Stack (TheStack.technology)

Banks – and Google – Open to Gemini-Powered Exfil via Public API Keys, Researchers Say

Security firm Truffle Security revealed that publicly exposed Google API keys can be upgraded to full‑access Gemini credentials, enabling data exfiltration from any organization using them. A November scan uncovered 2,863 such keys, affecting major banks, security vendors, and even Google itself. Google has classified the issue as a tier‑1 vulnerability and is rolling out blocks for known leaked keys, though a comprehensive fix is still in development. The flaw turns what were meant to be harmless identifiers into de facto passwords for the Gemini AI service.