A security vulnerability allows Google Cloud API keys, often embedded in public website code for services like maps, to be abused for unauthorized access to sensitive Gemini AI endpoints. These keys, when scraped from the internet, can let attackers access private files, cached data, and make costly Gemini API calls, leading to quota theft and large bills for victims. The issue is exacerbated because creating a new API key defaults to "Unrestricted," granting access to all project APIs, and enabling the Gemini API retroactively gives existing keys access without warning. Google has implemented measures to detect and block leaked keys attempting to access Gemini, and users are advised to audit and rotate old, publicly accessible API keys. The main topics covered are a security vulnerability in Google Cloud API keys, unauthorized access to Gemini AI endpoints, potential financial and data risks, and recommended mitigation steps.