Security researchers have found nearly 3000 publicly visible Google API keys authorizing Gemini. This allows abusive access.