The delayed‑revocation vulnerability

The issue stems from how credential changes propagate across Google’s distributed infrastructure. When a key is deleted, the revocation is not enforced simultaneously on every server handling API authentication. Some systems reject the credential quickly, while others may still accept it until the deletion update reaches them.

Aikido tested the behavior by repeatedly sending authentication requests after deleting newly created keys. During ten trials, successful authentication continued until revocation propagation completed, producing the observed 8–23 minute window with a median of about 16 minutes.

This means a key that appears deleted in the Google Cloud interface may still function briefly on parts of the platform.

Why the gap creates real risk

For organizations responding to a leaked credential, immediate revocation is critical. The delay uncovered by Aikido creates a period where attackers can continue using the key even after defenders believe it has been disabled.

If an attacker possesses a compromised key during that window, they may still be able to:

• Access enabled APIs tied to the project
• Send additional API requests
• Generate unexpected cloud usage or billing charges

The researchers confirmed the behavior with keys configured for Gemini, and observed the same delayed revocation for keys connected to other Google Cloud APIs such as BigQuery and Google Maps. The vulnerability is tied to the API key credential type itself rather than to a specific service.

Google’s response to the report

According to reports and Aikido’s disclosure, Google initially treated the behavior as an expected propagation delay in a distributed system rather than a critical security flaw. Some reports say the issue was initially closed as "won’t fix."

After further review, the report was later reopened and classified internally as a P0 bug, indicating high priority for investigation.

The underlying technical cause—revocation updates gradually propagating across infrastructure—means precise revocation timing can vary depending on which backend systems process a request.

Practical precautions for developers and security teams

Until revocation behavior is guaranteed to be immediate, security teams should assume that deleting an API key does not instantly block all access.

Recommended precautions include:

Treat deletion as a delayed containment step
Plan for a temporary risk window—roughly up to 30 minutes—during which a compromised key may still work.

Monitor logs and billing after revocation
Unexpected API calls or sudden usage spikes shortly after deletion may indicate continued abuse during the propagation window.

Restrict API keys wherever possible
Google recommends applying restrictions such as allowed referrers, IP addresses, or specific APIs so that a leaked key has limited utility.

Rotate and replace credentials
Instead of relying solely on deletion, rotate keys and update services to use newly generated credentials as quickly as possible.

The broader lesson for cloud security

The discovery highlights an important operational reality of large distributed systems: configuration changes, including credential revocation, often propagate gradually rather than instantly.

For developers and security teams, the takeaway is straightforward—“deleted” does not always mean “inactive immediately.” Defensive playbooks should account for short propagation delays whenever sensitive credentials are revoked.

The delayed‑revocation vulnerability

The issue stems from how credential changes propagate across Google’s distributed infrastructure. When a key is deleted, the revocation is not enforced simultaneously on every server handling API authentication. Some systems reject the credential quickly, while others may still accept it until the deletion update reaches them.

Aikido tested the behavior by repeatedly sending authentication requests after deleting newly created keys. During ten trials, successful authentication continued until revocation propagation completed, producing the observed 8–23 minute window with a median of about 16 minutes.

This means a key that appears deleted in the Google Cloud interface may still function briefly on parts of the platform.

Why the gap creates real risk

For organizations responding to a leaked credential, immediate revocation is critical. The delay uncovered by Aikido creates a period where attackers can continue using the key even after defenders believe it has been disabled.

If an attacker possesses a compromised key during that window, they may still be able to:

• Access enabled APIs tied to the project
• Send additional API requests
• Generate unexpected cloud usage or billing charges

The researchers confirmed the behavior with keys configured for Gemini, and observed the same delayed revocation for keys connected to other Google Cloud APIs such as BigQuery and Google Maps. The vulnerability is tied to the API key credential type itself rather than to a specific service.

Google’s response to the report

According to reports and Aikido’s disclosure, Google initially treated the behavior as an expected propagation delay in a distributed system rather than a critical security flaw. Some reports say the issue was initially closed as "won’t fix."

After further review, the report was later reopened and classified internally as a P0 bug, indicating high priority for investigation.

The underlying technical cause—revocation updates gradually propagating across infrastructure—means precise revocation timing can vary depending on which backend systems process a request.

Practical precautions for developers and security teams

Until revocation behavior is guaranteed to be immediate, security teams should assume that deleting an API key does not instantly block all access.

Recommended precautions include:

Treat deletion as a delayed containment step
Plan for a temporary risk window—roughly up to 30 minutes—during which a compromised key may still work.

Monitor logs and billing after revocation
Unexpected API calls or sudden usage spikes shortly after deletion may indicate continued abuse during the propagation window.

Restrict API keys wherever possible
Google recommends applying restrictions such as allowed referrers, IP addresses, or specific APIs so that a leaked key has limited utility.

Rotate and replace credentials
Instead of relying solely on deletion, rotate keys and update services to use newly generated credentials as quickly as possible.

The broader lesson for cloud security

The discovery highlights an important operational reality of large distributed systems: configuration changes, including credential revocation, often propagate gradually rather than instantly.

For developers and security teams, the takeaway is straightforward—“deleted” does not always mean “inactive immediately.” Defensive playbooks should account for short propagation delays whenever sensitive credentials are revoked.