Home / Technology / Google API Keys: A 23-Minute Security Gap
Google API Keys: A 23-Minute Security Gap
23 May
Summary
- Google API keys can remain active for up to 23 minutes after deletion.
- Gemini-enabled projects are particularly vulnerable to data exfiltration.
- Google acknowledges propagation delay but considers it not a security issue.
Researchers have discovered a critical security flaw where Google API keys remain usable for an extended period, up to 23 minutes, after being deleted. This significant time window presents a substantial risk, allowing threat actors to potentially access sensitive data.
The vulnerabilities are particularly acute for projects utilizing Gemini, where uploaded files and cached conversations can be exfiltrated using seemingly deleted keys. Aikido researchers conducted trials, observing inconsistent revocation times ranging from 8 to 23 minutes, with unpredictable success rates for authentication requests post-deletion.
Google has categorized this issue as a propagation delay, a known system characteristic, and stated it will not be addressed as a security concern. However, Aikido recommends treating API key deletion as a 30-minute operation and actively monitoring Google Cloud Platform for any unexpected API usage during this interval.
