New Delhi: Artificial intelligence is reshaping cybersecurity faster than many companies can adapt. Artificial intelligence is changing the cybersecurity landscape
at a pace that is exceeding businesses’ ability to catch up. As technology companies are advising enterprises to bolster their AI security, recent events have revealed that even the largest cloud providers are still learning how to manage AI risks on the fly. The rising number of AI systems introduces vulnerabilities that are already being leveraged by attackers, including unsecured API keys and credentials that aren’t revoked until hours after deployment.
Google Cloud Chief Operating Officer Francis de Souza said in a backstage interview at the event in Los Angeles that companies can no longer afford to take security for granted in the era of AI. He cautioned that governance processes are not in place around AI tools, and their adoption poses new risks that aren’t being managed by traditional security controls. His remarks coincide with Google’s own security problems linked to its Gemini AI product being called into question, as reported by The Register and security experts at Aikido.
AI security can no longer be an afterthought
De Souza emphasised the need to design AI systems with security and governance at the core, from the outset. On the consumer side, he cautioned against the “shadow AI” approach where employees are using consumer AI tools without their employers being aware of it.
“If you don’t have a data strategy and a security strategy, there is no AI strategy,” de Souza said during the discussion. He said that it is important for companies to have common security procedures on several different cloud platforms, as most businesses are already using multiple cloud providers, SaaS applications and third-party systems.
The speed of cyberattacks has also never been so fast, he added. The average time that it takes for an initial breach to the next phase of an attack has reportedly dropped from eight hours to just 22 seconds, de Souza said. Meanwhile, the attack surface has grown from networks to encompass AI models, prompts, agents, and training pipelines.
AI agents could expose forgotten enterprise data
A new issue is the presence of AI agents in the company’s internal systems. De Souza cautioned that these agents could discover obsolete and insecure data repositories that no one has looked at for years.
He mentioned a number of legacy systems, including those that have been running on old SharePoint servers, which have poor access controls. While previously unnoticed in enterprise environments, AI agents can now easily find and surface sensitive information more readily within these systems.
De Souza said organisations must have “AI-native” defences that can run at machine speed to alleviate these threats. He envisioned a future where AI agents would be proactive in protecting enterprise systems, and human teams would manage the process rather than react to each threat individually.
“This is a board-level issue and an executive team issue,” he said, emphasising that AI security is no longer just the responsibility of cybersecurity departments.
Industry experts warn of a growing ‘bug-pocalypse’
Security researchers outside of Google are also sounding the alarm regarding the lack of progress in the industry with regards to AI vulnerabilities.
Companies will need more experts to deal with a looming “bug-pocalypse”, said Lea Kissner, a chief information security officer at LinkedIn, recently in an interview with The New York Times. It may take years for the tech industry to arrive at a full grasp of how to make AI systems sustainable, she added.
The alert comes shortly after the vulnerabilities associated with generative AI tools have surfaced in various cloud platforms and enterprise systems.
Google Cloud faces criticism over Gemini API security issues
Meanwhile, Google Cloud has come under fire after several news reports of developers getting huge bills for using the Gemini API without permission.
These findings were revealed in investigations released by The Register, which claim that several developers found their API keys had been granted access to Google Maps’ AI capabilities without their knowledge. The investigation, released by The Register, says several developers noted that their API keys were suddenly enabling access to Google Maps AI services when they had not expected. Many of the developers reportedly became aware of the fact that the keys can also be used for AI-related requests.
The attackers used one of his API keys and made over $10,000 worth of charges in about 30 minutes, Rod Danan, CEO of interview-prep site Prentus, told The Register. Sydney-based developer Isuru Fonseka reportedly got caught up in a charge of approximately AUD $17,000, despite having a spending cap in place for his account.
The reports also said that Google’s systems automatically raised billing tiers for some accounts based on usage history, without explicit approval from the users, and thus raised their spending limit. Google later reimbursed affected developers as a result of media coverage of incidents.
Researchers question Google’s response speed
Cybersecurity firm Aikido added to worries about the ease of revoking Google API keys.
Although API keys are deleted from the list, attackers could still be able to use them for up to 23 minutes, as the deletion trickles through Google’s infrastructure, researcher Joseph Leon told The Register. During this period of time, the attackers are able to retrieve files and the cached Gemini conversation information.
Newer versions of the Google credentials seem to be revoked more rapidly, Leon said. The service account credentials are said to cease to function within seconds, while newer keys that use the prefix “AQ” for Gemini keys expire after about a minute.
In a related research paper, Leon states that the revocation window for older API keys seems like a design decision and not a technical constraint.
A growing gap between advice and execution
De Souza’s warnings echo the tech industry’s larger security challenge: that security systems are catching up with AI developments. While industry is increasingly demanding that companies implement better governance, more rapid defences and more stringent controls, the recent Google Cloud incidents have shown that even big platform companies are still learning to deal with challenges.
The surge of AI adoption in companies around the globe is making it harder and harder to ignore the security recommendations that need to be implemented.
