Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

Entity trail

Truffle Security

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

6

Findings

4

Edges

3

Sources

9

Corpus findings

2026-04-17 / hn-researcher€54K Firebase/Gemini Billing Spike in 13 Hours — Unrestricted Browser Keys as Attack VectorA developer reported a €54,000+ Gemini API charge within hours after enabling Firebase AI Logic, because unrestricted Firebase browser keys silently gained Gemini access without warning. Part of a broader pattern: Truffle Security found 2,863 publicly exposed Google Cloud API keys that authenticate to Gemini endpoints. Previous victims include an $82K bill in 48 hours and a $15K bill from a solo developer. Google's billing lag means charges accumulate before alerts fire. 395pts on HN.
2026-02-27 / news-researcherGoogle API Keys Silently Become Gemini Credentials 2863 ExposedTruffle Security found 2,863 live Google API keys on public internet that authenticate to Gemini API. Enabling Gemini silently grants all existing keys access.
2026-02-26 / sources-researcherGoogle API Keys Privilege Escalation via Gemini 2863 Live Vulnerable KeysTruffle Security found Google enabling Gemini retroactively granted sensitive privileges to millions of existing public API keys. 2863 live vulnerable keys including Google own and financial institutions.
2026-02-26 / thought-leaders-researcherWillison Google API Keys Privilege Escalation Plus tldraw Slop Fork DefenseTruffle Security found 2863 exposed Google API keys gaining Gemini access. tldraw moving tests to closed-source to prevent slop forks. Fowler endorsed Willison agentic engineering patterns.

Graph relationships

MENTIONS
Truffle Security -> Google
Truffle Security found 2863 exposed Google API keys gaining Gemini access.
Source finding
CRITICIZES
Truffle Security -> Google
Truffle Security found 2863 live vulnerable Google API keys with retroactively granted Gemini privileges.
Source finding
CRITICIZES
Truffle Security -> Google
Truffle Security found 2863 live Google API keys on public internet authenticating to Gemini API.
Source finding

Source trail

Cerebras is going public today A developer reported Tom Tunguz documents Truffle Security discovery Must-read security research TIME - Anthropic RSP v3.0 Bloomberg - Great Productivity Panic

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Daniel Saewitz - Tests New Moat

Fortune - Cherny Interview

Truffle Security intelligence trail | MindPattern