'$15K bill destroyed a solo developers startup': How hackers are using leaked Google API keys to go wild with Gemini AI for free

Date:
Sat, 11 Apr 2026 17:35:00 +0000

Description:
Developers public API keys now function as live Gemini AI credentials, enabling attackers to run costly and unauthorized operations.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Tech Radar Pro Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Become a Member in Seconds Unlock instant access to exclusive member features. Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over. You are
now subscribed Your newsletter sign-up was successful Join the club Get full access to premium articles, exclusive features and a growing list of member rewards. Explore An account already exists for this email address, please log in. Subscribe to our newsletter Exposed Google API keys allow attackers to
run unlimited Gemini AI requests Developers experience severe financial
losses due to unauthorized access to AI infrastructure Hardcoded credentials elevate public identifiers into active authentication tokens for Gemini AI Developers are facing severe consequences as exposed Google API keys are exploited to access Gemini AI without authorization, leading to significant financial losses, experts have warned.

Security researchers from CloudSek found the root cause of these incidents lies in the unintended elevation of publicly available API keys into live Gemini AI credentials. Many developers have long embedded keys for services like Maps or Firebase in public-facing applications, following Googles official guidance - never anticipating these keys would gain access to the AI infrastructure. Article continues below You may like Shock report claims Android apps have leaked over 730TB of user data and Google secrets - here
are some of the worst offenders around AI malware, Gemini lures and more: Google reveals how hackers are actually using AI Security study finds thousands of API credentials exposed on the web for years Elevation of publicly available API keys is the root cause One case involved a solo developer whose startup nearly collapsed after an attacker used a publicly accessible key to flood Gemini AI with inference requests.

The developer revoked the key within minutes of receiving a billing alert,
yet due to a reporting lag in Google Clouds billing system, the charges had already reached $15,400.

Similarly, a Japanese company experienced approximately $128,000 in unauthorized Gemini API usage, despite firewall -level IP restrictions.

Also, a small development team in Mexico saw an $82,314 spike in only 48 hours, a dramatic 455-times increase over typical spending. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get
all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting
your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

This issue does not stem from developer negligence; the implementations were compliant with Googles prescribed guidelines, said Tuhin Bose, cybersecurity researcher at CloudSEK.

He explained the architecture effectively converted non-sensitive identifiers into authentication tokens, creating a systemic vulnerability across numerous applications.

CloudSEKs research identified 32 exposed Google API keys across 22 Android applications with a combined install base exceeding 500 million users. What
to read next A Google Gemini security flaw let hackers use calendar invites
to steal private data Hackers are going after top LLM services by cracking misconfigured proxies 'What if the AI agent you just deployed was secretly working against you?': Vertex AI 'double agent' flaw exposes customer data
and Google's internal code

The affected apps include household names such as OYO Hotel Booking App, Google Pay for Business, Taobao, and ELSA Speak.

Researchers confirmed data exposure in ELSA Speak when they accessed user-submitted audio files via the Gemini Files API.

The vulnerability allows attackers to perform unlimited Gemini API calls, access sensitive user data, and exhaust organizational API quotas.

It can also persist through app update cycles, severely impacting both developers and end users.

Developers who had followed Googles guidance now unknowingly hold live credentials to powerful AI tools without notification or opt-in prompts.

Technical measures such as revoking keys and restricting project permissions can mitigate exposure.

However, the financial and operational impact on developers is substantial, suggesting that current practices for handling API keys and AI integrations require immediate reevaluation.

Exposure of hardcoded credentials demonstrates the risks inherent in assuming backward compatibility for modern AI-enabled cloud services. Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.



======================================================================
Link to news story: https://www.techradar.com/pro/security/usd15k-bill-destroyed-a-solo-developers -startup-how-hackers-are-using-leaked-google-api-keys-to-go-wild-with-gemini-a i-for-free


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)