Signal
Deleted Google API keys remain active for up to 23 minutes after deletion
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-05-21 20:23 UTCUpdated 2026-05-22 12:08 UTC
rss
security_toolingincident_response
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (2 domains)domains are deduped. counts indicate coverage, not truth.2 top sources shown
limited source diversity in top sources
Overview
Security researchers at Aikido have discovered that Google API keys continue to function for up to 23 minutes after users delete them.
Score total
0.96
Momentum 24h
2
Posts
2
Origins
2
Source types
1
Duplicate ratio
0%
Why now
- Research was recently published revealing the delay in Google API key revocation.
- Growing reliance on Google APIs and Gemini AI increases potential impact of such vulnerabilities.
- Organizations must reassess their incident response strategies for leaked API keys.
Why it matters
- Attackers can exploit deleted API keys for up to 23 minutes, increasing risk of unauthorized access and financial damage.
- Delayed key revocation undermines user confidence in immediate mitigation after key compromise.
- Highlights need for improved API key management and faster revocation mechanisms.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
- Deleted Google API keys remain usable for up to 23 minutes after deletion.
How sources frame it
- Aikido Security Researchers: neutral
This report highlights a critical delay in Google API key revocation that could impact many users relying on Google services.
All evidence
All evidence
Deleted Google API keys keep working for up to 23 minutes, researchers warn
Help Net Security · helpnetsecurity.com · 2026-05-22 12:08 UTC
Threat hunters find Google API keys still usable 23 minutes after deletion
theregister_security · theregister.com · 2026-05-21 20:23 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 2Origin domains: 2Duplicates: -
Showing 2 / 0
Top publishers (this list)
- Help Net Security (1)
- theregister_security (1)
Top origin domains (this list)
- helpnetsecurity.com (1)
- theregister.com (1)