Home
Apps
Apps News
Major Google Bug Triggers Gemini AI Leak in Google Pay for Business, Oyo Hotels and Other Apps: Report

Major Google Bug Triggers Gemini AI Leak in Google Pay for Business, Oyo Hotels and Other Apps: Report

A CloudSEK report has found hardcoded Google API keys in Android apps that expose Gemini credentials.

Written by Akash Dutta, Edited by Ketan Pratap | Updated: 9 April 2026 17:01 IST

Major Google Bug Triggers Gemini AI Leak in Google Pay for Business, Oyo Hotels and Other Apps: Report

Photo Credit: Unsplash/Daniel Romero

CloudSEK has found 32 keys in 22 Android apps with more than 10 million installations

Click Here to Add Gadgets360 As A Trusted Source

Highlights

These API keys were previously used as public identifiers
Gemini integration in Android apps adds authentication to the keys
Bad actors can steal user data and trigger unauthorised usage

Google's implementation of an application programming interface (API) key architecture has reportedly led to a massive Gemini exposure risk in Android apps. As per the cybersecurity research firm CloudSEK, a particular client-side API key, which previously functioned as an identifier, receives credential privileges after an Android app integrates the Gemini API. This, in the hands of a bad actor, can expose the data users share with the chatbot. Additionally, this can also result in bad actors making unauthorised Gemini API calls, racking up huge bills for the developer.

How a Google API Key Triggers Gemini Exposure

In a blog post, CloudSEK explained how an API key (AIza...), which was deemed safe by Google to add to the codebase of Android apps, suddenly gains credential privileges after Gemini is integrated into the app. This security flaw builds on the findings of Truffle Security, which found a similar flaw on a Google Cloud project.

CloudSEK's BeVigil, a mobile app security search engine, scanned the top 10,000 Android apps (based on number of installs) and found 32 live Google API keys hardcoded in 22 different apps with more than 500 million installs collectively. Some of these apps are Oyo Hotel, Google Pay for Business, Taobao, apna Job Search App, Elsa Speak, HD Sticker & Pack WAStickersApps, The Hindu, ISS Live Now, and more.

Meta Said to Pause Work With Mercor Following Data Breach Incident

Interestingly, the report claims that the API key format Alza… is added to the app when a developer wants to embed Maps or Firebase, as per the documentation instructions shared by Google. However, after enabling the Generative Language API, the key gains access to all Gemini endpoints without any warning or notification. So, anyone who decompiles the app can easily gain access to the key, and it acts like a live Gemini credential.

For end users, this means any data shared with Gemini, such as documents, images, or audio, and stored in the Files API, can be accessed by the bad actor. Additionally, all sensitive information in the cached AI context can be read, copied, or exfiltrated by the one gaining unauthorised access.

Developers and publishers also face significant risks. Gemini API integration is not free. Developers pay for any usage. So, if the bad actor ends up making unauthorised usage, it can rack up massive bills. Additionally, this also puts a regulatory burden on the companies if the users' data is compromised.

CloudSEK recommends developers and companies review all API keys in a GCP project, rotate any key that is embedded in a mobile app, restrict keys by service, and not hardcode any API key in the mobile app source code. While end users cannot do much, they should be careful about using Gemini services in an Android app. If they do not trust the app, they should limit their Gemini interaction to the official app and platforms.

Comments

Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.

Further reading: Google, Gemini, Google API, Android apps, Oyo, Google Pay, Cybersecurity, AI, Artificial Intelligence, Enterprise

Akash Dutta Email Akash Dutta

Akash Dutta is a Chief Sub Editor at Gadgets 360. He is particularly interested in the social impact of technological developments and loves reading about emerging fields such as AI, metaverse, and fediverse. In his free time, he can be seen supporting his favourite football club - Chelsea, watching movies and anime, and sharing passionate opinions on food. More