Previously harmless Google API keys now expose Gemini AI data
Private information could be accessed and the Gemini AI assistant authenticated using Google API keys for services like Maps integrated in easily accessible client-side code.
While examining websites from businesses in a variety of industries, including Google, researchers discovered around 3,000 such keys.
The issue arose when developers began activating the LLM API in projects when Google released its Gemini assistant. Prior to this, Google Cloud API keys were not regarded as sensitive information and could be safely shared online.
To add further functionality to a project, developers can employ API keys for YouTube embeds, Firebase services, or loading maps on a website to share a location.
Google Cloud API keys served as Google's AI assistant's authentication credentials w...