Gemini Safety Bypass: Refused Images Could Still Be Downloaded, What Is Confirmed and What Businesses Should Check

Google's Gemini app could refuse to create an image on safety grounds and still deliver that refused image through its download button, according to a report published November 5, 2026 by Jason Kao of Fog Security. If your staff use Gemini for marketing or presentation images, the file they saved may not be the one they saw on screen, and that can put unreviewed content in your shared folders.

What is the Gemini safety bypass?

Fog Security reports that each image generated in the web app at gemini.google.com/app had two addresses. One served the preview in the conversation (ending =s1024-rj), and the other served the full-size file behind the download icon (ending =s0-d-I). Both were on lh3.googleusercontent.com and were supposed to be the same image.

Fog says they were not always the same. After Gemini refused a prompt, the researchers asked for a different, harmless image. The chat displayed the harmless one, but the download link returned an image that had triggered the safety filter. Sometimes that file was a blurry or partial early render. Sometimes it was a fully formed image, and Fog says it reproduced those on multiple runs across different days and sessions.

This was not a jailbreak or prompt injection. In Fog's words: "The model wasn't tricked. The infrastructure around it failed."

Fog tested sexualized and copyrighted images, using Mickey Mouse, a synthetic person and the author's own headshot. It says it did not test child safety categories or real third parties.

What is confirmed, and what is only claimed

Reported by Fog Security, not independently confirmed. The behavior above comes from one researcher's testing, backed by demonstration videos. The report does not describe outside replication, and we did not reproduce it. Its explanation of the cause is a stated guess: "We surmise the cause was a state-management issue," possibly a race between generation, the safety abort and artifact cleanup.

Google's position, as recorded in Fog's timeline:

From Google directly. We found no Google advisory or public statement about this. Google's Gemini API safety documentation says that when a filter blocks a response, "The blocked content isn't returned," but that page covers the API, and Fog's testing covered the web app.

Not known. How many people received a refused image. Whether Google Workspace accounts, the mobile apps, the Gemini API or Vertex AI behaved the same way. Which account type Fog used. The confirmed root cause. When the change happened, and whether refused files were deleted.

What the Gemini image download flaw means for a business

This is not a data breach. Fog states that "Nobody else's data was exposed, there was no privilege escalation," and says the links were bound to the signed-in user and did not open in an incognito window.

The risk is control over content. Fog warns that "even a user who never wanted the image won't know until it lands in their downloads." Our reading: someone in marketing could save what they believe is an approved graphic and place an image nobody reviewed into a shared drive, a slide deck or a scheduled post. Google's Generative AI Prohibited Use Policy bars sexually explicit content and violating others' intellectual property rights, so a sexualized image on a work laptop or a copyrighted character in an ad is more than a harmless mix-up.

What to do this week: Gemini image checklist

There is nothing to install. Google runs the web app, and the report cites no CVE number or patch. Your controls are process and access.

If your company builds AI features

Fog's two recommendations to Google apply to any AI product you run:

• Bind each download to the exact image shown to the user.
• Clean up artifacts from refused and failed generations so they cannot be retrieved.

We would add two of our own:

• Test every way out, including previews, downloads, share links, API responses and cached copies. Try to fetch a refused result through each one.
• Ask your AI vendors in writing how blocked outputs are stored, for how long, and who can retrieve them.

As we wrote in Updated Is Not the Same as Patched, a vendor's word that something changed does not prove what changed. And while AI can build your app, someone still has to own these checks after launch.

Gemini safety bypass questions people are asking

Was Google Gemini hacked?

No hack has been reported. Fog describes a failure in how refused images were handled, and says no one else's data was exposed.

Is this a Gemini jailbreak?

No. Fog says the filter refused correctly and nobody had to trick the model. The problem was the download path.

Can other people download my blocked Gemini images?

Fog says the links were tied to the signed-in user and failed in an incognito window. It does not describe any wider access testing.

Has Google fixed the Gemini image download problem?

Not in any documented way. Fog's October 22 retest could not reproduce it, but Google attributed the change to routine maintenance and published no fix. Twelve clean attempts do not prove it is gone in every case.

Why did Gemini download a different image from the one on screen?

The confirmed cause is not public. Fog says users have reported this since at least December 2025, including in a thread on Google's support forum. Those users did not connect it to refused content, and a wrong download may have other causes.

Does this affect Google Workspace or the Gemini API?

Unknown. Fog's report covers the web app and does not address Workspace, the API or Vertex AI.

The bigger lesson

A safety control only counts if every route to the content enforces it. Fog puts it this way: "A refusal without enforcement isn't a safety control." The same test applies to permissions, approvals and paywalls in any business system. What the screen shows is one path, and the file behind it is another, so check both.

Want the paths around your AI tools and websites tested? See security hardening or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: Fog Security report; Google Gemini API safety settings; Google Workspace Help: Turn the Gemini app on or off; Google Workspace Updates, December 20, 2025; Google Generative AI Prohibited Use Policy; Google Gemini support forum thread.