Security researchers identify 23-minute window for Google API key misuse after revocation

Source:The Register

02 — Who / Subject

Aikido, Google

03 — Where / Locus

Global

04 — When / Temporality

May 22, 2026

Verified: May 22, 2026

05 — Why / Core Summary

"Researchers at Aikido found that Google API keys can remain active for up to 23 minutes after deletion. This delay allows attackers to continue using leaked keys to incur costs or exfiltrate data. Google has classified this as 'Won't Fix (Infeasible)'."

Conflict Analysis

This highlights a significant security vulnerability in cloud infrastructure management.

Recommended Background Resource

Affiliate / AdAI Curation

The Art of Invisibility

Author: Kevin Mitnick

This book provides deep insights into how security vulnerabilities are exploited and the importance of understanding system architecture, which is crucial for grasping why API key propagation delays pose significant risks in cloud environments.

Explore Background Book (Amazon)

As an Amazon Associate, COMPAMIR earns from qualifying purchases.

Post