Gemini Bypass Let Users Download Blocked Images
Researchers say Google's Gemini app delivered images its own safety filters had refused to display, and Google closed the report without an internal ticket.
Updated on Nov. 9, 2026 in Artificial Intelligence
Live Poll
Do you trust AI image tools to consistently block the content they refuse?
Fog Security published research on November 5, 2026, describing a flaw in Google's Gemini app that let users download AI-generated images the safety filters had rejected. The bypass did not require a jailbreak, and the download feature sometimes delivered a rejected image while the conversation displayed a different, permitted one.
Why it matters
The finding shows that a safety check applied to what a chatbot displays may not cover the file a user can actually save. Google's handling of the report, which it closed without filing an internal ticket, raises questions about how such abuse-related flaws are tracked.
Researchers tested the download feature across repeated attempts, with results ranging from blurry, unfinished files to complete images, and both image URLs used lh3.googleusercontent.com with the signed-in user's session. Google attributed the change in behavior to routine maintenance rather than a fix tied to the report, and the underlying mechanism remains unexplained.
The players
Google is the technology company that operates the Gemini app and its image-generation and safety systems, and it closed the researchers' report without filing an internal ticket.
Fog Security
Fog Security is a security research firm that reported the Gemini download flaw to Google and published its findings on November 5, 2026.
The details
Researchers first submitted a request that triggered a refusal, then asked for a different, permitted image; the download button for the permitted image sometimes retrieved the rejected output. Fog Security reported the issue to Google in June 2026, and Google initially marked it out of scope before later declining to track the abuse bug.
Timeline
June 2026: Fog Security reports the issue to Google.
June 25, 2026: Google initially marks the report out of scope.
September 30, 2026: Google declines to track the abuse bug.
October 22, 2026: Researchers can no longer reproduce the issue across 12 attempts.
October 23, 2026: Google closes the report without filing an internal ticket.
The Tech Race
The episode reflects the broader arms race among AI chatbot makers to balance image generation with safety filtering, where a control on the visible output can diverge from the file a user saves. Gemini's refusal behavior is the reference point here, since the flaw concerned whether those filters governed the downloadable image itself.
Users of the Gemini app could in some cases save images that the app itself had declined to show, so the reliability of its content refusals depends on the downloadable file matching what the chat displays. Researchers reported the behavior no longer reproduced by late October, but Google has not confirmed a fix.
The takeaway
Safety controls over an AI tool's visible output do not automatically cover every file it produces, so users and reviewers should test the downloadable result as well as the displayed one. Google has not confirmed the cause of the flaw, and the cause of its disappearance remains unclear.
Further reading
For more on how these systems are built and policed, see Artificial Intelligence coverage.
Source note: This article includes information reported by Cyber Security News.
Live Poll
Do you trust AI image tools to consistently block the content they refuse?
