I’m sick of gaslighting. Google is in a desperate, balls-to-the-wall race to prove Gemini is the dominant AI model. OpenAI, Anthropic, and everyone else are breathing down their neck. So what’s the easiest, dirtiest way to pump insane token usage numbers for earnings calls? Silently turn every single legacy AIza... API key on the internet into a valid Gemini credential. Here’s the timeline they can’t deny: - Jan 13, 2026: Google’s own VDP team classifies the bug as Tier 1 — “Single-Service Privilege Escalation.” They knew exactly what was happening. - They had the simplest fix in the world: Don’t attach Gemini to past keys. Or at minimum, email every dev who ever created a Maps/Firebase key: “Hey, enabling Gemini just made your public key an AI credential — rotate it now.” - They did nothing - still nothing as of May 2026. No warning. No separation. No retroactive revocation. - Truffle Security publicly dropped the bomb on Feb 25 after a 90-day disclosure window.…