Researchers from Fog Security have uncovered a vulnerability in Google Gemini that permitted users to download AI-generated images which had been initially blocked by Google’s safety filters. This issue, highlighted in a study released on November 5, 2026, raised significant concerns about the robustness of image safety protocols.
Discovery of the Safety Bypass
The flaw in Google Gemini’s system did not necessitate any complex jailbreaks to exploit. Instead, a peculiar behavior in the download feature allowed rejected images to be downloaded, even as the chat interface displayed an alternative, approved image. This discrepancy was first reported to Google in June 2026. By late October, the issue seemed to have resolved itself, with attempts to replicate the bypass resulting in the correct images being downloaded.
Google’s Response and Technical Details
Google’s response attributed the resolution to routine maintenance activities, rather than any specific fix prompted by Fog Security’s report. The glitch involved the Gemini web app’s download path, which bypassed restrictions that were otherwise enforced within chat interactions. Researchers managed to reproduce the flaw by initially requesting an image that triggered a rejection, then switching to a different request. Although the permitted image was shown, the download occasionally retrieved the previously refused content.
The URLs for these images utilized Google’s lh3.googleusercontent.com service, and downloads were dependent on the session of the signed-in user. The disparity between inline and downloaded image links suggested a potential state-management error related to image generation and safety checks.
Implications and Recommendations
While the researchers did not find evidence of unauthorized data access or privilege escalation, the implications for AI safety are substantial. Fog Security emphasized the importance of aligning download links with approved previews and recommended the removal of files generated from denied requests. This incident underscores the need for comprehensive AI safety testing, extending beyond chatbot responses to include all potential delivery paths.
Google initially categorized the report from June as out of scope, only revisiting it after further insistence from the researchers. Despite declining to label it as an abuse bug, the incident highlights critical areas for improvement in managing AI-generated content safely.
Fog Security’s findings serve as a crucial reminder of the complexities inherent in AI safety, urging developers to ensure consistency across all access points to mitigate risks effectively.
