- Aikido researchers find Google API keys remain usable for up to 23 minutes after deletion
- Success rates varied across trials, with Gemini‑enabled projects especially vulnerable to stolen files and cached conversations
- Google dismisses issue as propagation delay, but Aikido advises treating deletion as a 30‑minute window and monitoring for unexpected usage
If, when you delete a Google API key, expect it to no longer work - effective immediately - we have a surprise for you.