Google Gemini allowed users to download AI-generated images that its safety filters had refused to show, according to research published by Fog Security on November 5, 2026. The bypass did not need a jailbreak, and the download feature sometimes returned a rejected image while the chat window showed a different picture that was allowed.
Fog Security’s June report and Google’s response
Fog Security reported the issue to Google in June 2026. By October 22, researchers could no longer reproduce it across 12 new attempts, and older conversations downloaded the correct images. Google said the change came from routine maintenance rather than a fix tied to the report.
The web app path that failed
A Gemini web app flaw let blocked images bypass safety refusals through the full-size download path, even though the images stayed blocked in chat. Researchers first submitted a request that triggered a refusal, then asked for a different image that was allowed. The allowed picture appeared on screen, but the download button sometimes fetched the rejected output.
Results ranged from blurry, unfinished files to complete images, and successful tests happened across multiple days and sessions. Both image URLs used lh3.googleusercontent.com and required the signed-in user’s session. Inline links ended in =s1024-rj, while download links ended in =s0-d-I.
What researchers suspected and what they ruled out
Fog Security suspected a state-management error involving image generation, safety checks, and cleanup. That explanation remains unconfirmed. A December 2025 Google community report had also described downloads returning older images instead of the preview that was displayed, but that complaint did not establish a safety bypass.
The issue also differed from prompt injection aimed at Gemini’s memory, which depends on hidden instructions changing the assistant’s behavior. It also differed from AI jailbreaks that use assistant prefill to push models toward prohibited answers. In this case, the refusal stayed in place while file delivery failed to enforce it.
Scope of the tests and Google’s handling
Fog Security tested copyrighted characters, a synthetic person, and the researcher’s own likeness. It did not test child safety content or images involving other real people. No access to another user’s data or privilege escalation was reported.
Google first marked the June 25 report out of scope, then reviewed it after researchers stressed the infrastructure issue. It declined to track an abuse bug on September 30. On October 23, Google said no internal ticket had been filed and closed the report.
Download paths need the same checks as previews
Fog Security recommends binding each download to its approved preview and removing files from refused or failed generations. The finding shows why AI safety testing must cover stored files and download links, not only chatbot replies. A refusal protects users only when every delivery path follows the same decision.
Licensed under CC BY-ND 4.0 International