Ever since AI has seen rapid advancements, data exposure and leaks have become common terms that we hear every day, and it is dangerous. Yet again, a newly surfaced cybersecurity report has flagged potential data exposure risk tied to Google’s Gemini integration in Android apps, including some big names, such as OYO Hotel Booking App, Google Pay for Business (50M+ installs), Taobao (50M+ installs), apna Job Search App (50M+ installs), ELSA Speak: AI English Learning (10M+ installs).
According to findings by CloudSEK, a commonly used Google API key, which was previously considered safe for client-side use, can gain elevated privileges once the Gemini API is enabled, potentially allowing unauthorised access to sensitive data and services.
The issue comes from API keys that developers often embed in the apps for services like Maps or Firebase. While these keys were initially designed to function as identifiers, the report claims that they can inadvertently turn into active credentials after Gemini’s Generative Language API is integrated. This means that if a hacker extracts the key by reverse-engineering the app, they could gain access to Gemini endpoints without additional authentication.
Also read: Apple iOS 26.4.1 update is here and it fixes a critical iCloud issue
The report stated that it analysed 10,000 widely used Android apps and found dozens of exposed API keys across several apps with a combined install base of over 500 million. The report also stated that the vulnerability builds on earlier research by Truffle Security, which pointed to similar risks in the Google Cloud environment.
For the users, this can be serious. Data shared with Gemini-powered features, including the files, images and contextual AI interactions, can become accessible if keys are compromised. At the same time, developers can face financial and regulatory risks as the attackers can misuse these keys to make unauthorised API calls.
The report also urged developers to audit their API Key usage and avoid embedding sensitive keys directly in app code and apply strict access restrictions.