Google API Keys Quietly Gain Access to Gemini on Android Devices (infosecurity-magazine.com)

• Hardcoded API keys in Android apps are a security risk.
• Attackers can use stolen keys to access Gemini AI.
• Potential for unauthorized billing and data exposure.

"A flaw in Google API key implementation on Android devices allows unauthorized access to Gemini AI services, potentially exposing private files and leading to billing abuse. Developers who embed API keys in mobile apps are at risk, as attackers can exploit them to make costly AI queries without consent."