Generative AI Rollout Exposes Hidden Risk in Google Cloud API Keys
2026-02-28
Analytics Insight
The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.
Researchers discovered that legacy Google Cloud API keys, previously considered safe to embed in public code, now grant unauthorized access to Gemini AI endpoints. This exposes private data and allows attackers to incur significant financial charges, affecting thousands of organizations, including Google itself. The incident highlights a critical security vulnerability in Google's AI integration.[AI generated]
Why's our monitor labelling this an incident or hazard?
The event involves an AI system (Google's generative AI service Gemini AI) and its integration with cloud API keys. The misuse of these keys can lead to unauthorized access to AI services, resulting in potential harm such as data exposure (harm to property and possibly to communities) and financial damage (mounting AI bills). This constitutes harm directly linked to the use of an AI system, fulfilling the criteria for an AI Incident.[AI generated]