Google API Keys Privilege Escalation (Truffle Security)

Must-read security research: when Google enabled Gemini API, millions of existing public API keys retroactively gained sensitive privileges. 2,863 live vulnerable keys found via Common Crawl scanning, including keys belonging to Google itself and major financial institutions. New vulnerability class: API surface expansion creates retroactive secrets. Root-cause fix still in progress.