Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-02-26 · source-backed
Today's big security find from Willison: Truffle Security discovered 2,863 exposed Google API keys that silently gained Gemini access when Google enabled the Gemini API. Keys intentionally made public for Maps became secret credentials with no notification. Google classified it as Tier 1 privilege escalation. Root-cause fix still in progress. This is a new vulnerability class: API surface expansion creates retroactive secrets out of previously-public credentials. Audit any GCP project using client-side API keys immediately.
Each link below shares sources, entities, or timing with this story.
Simon Willison highlighted the Truffle Security discovery: Google Maps API keys designed to be embedded publicly in web pages can access Gemini AI endpoints, because Gemini uses the same API key system. The trust model between "public" Maps keys and "secret" AI model keys was...
Must-read security research: when Google enabled Gemini API, millions of existing public API keys retroactively gained sensitive privileges. 2,863 live vulnerable keys found via Common Crawl scanning, including keys belonging to Google itself and major financial institutions....
"Gemini is Cooked but GCP is Cooking" argues Google quietly shelved 3.5 Pro, which industry chatter placed at roughly Opus 4.5 level, shipping Gemini 3.6 Flash as a bridge the authors call worse than Muse Spark 1.2, Grok 4.5, and tier-1 Chinese open-source models. The hard num...
ESET researchers disclosed PromptSpy, the first known malware that weaponizes Google's Gemini AI at runtime. The malware sends device screen data to Gemini, which returns natural-language instructions for achieving persistence — tapping specific UI elements, avoiding detection...
Google launched agentic video understanding across Gemini 3.7 Flash, 3.6 Flash and 3.5 Flash-Lite (Google). Instead of scanning a video start to finish at a fixed sample rate, the model runs an internal loop deciding what to watch, at what speed, and through which channel: fra...
Willison's August 13 release adds Gemini 3.7 Flash, 3.6 Flash and 3.5 Flash-Lite plus gemini-embedding-2 and -001, rebuilding on LLM 0.32's structured message and streaming APIs so reasoning, tool calls and results emit as typed stream events while preserving Gemini thought si...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.