VULNpocalypse
InformationalVulnerabilityMonitoring

Google Gemini download links returned images safety filters blocked

Fog Security found Gemini download links could return refused images; it stopped reproducing Oct 22, so builders should audit delivery paths.

Published
Exploitation
No, the sources describe researcher testing only and report no cross-user data exposure or privilege escalation

What happened

Fog Security published research on November 5, 2026 describing the issue, according to Cyber Security News and GBHackers. GBHackers names the researcher as Jason Kao.

Both outlets describe the same behavior. The researchers first submitted an image request that triggered a Gemini safety refusal, then requested a different, permitted image. The permitted image appeared in the conversation, but its download control sometimes returned the earlier, rejected image. GBHackers reports that returned files ranged from blurry or incomplete generation artifacts to fully formed images, with successful reproductions across multiple days and sessions. Cyber Security News says the same.

This was not a conventional jailbreak. The refusal itself stayed intact, and the problem was in file delivery. Both outlets report that the inline and download paths used lh3.googleusercontent.com and were tied to the signed-in user. Inline URLs ended in =s1024-rj and download URLs ended in =s0-d-I. GBHackers adds that the links did not resolve in an incognito session. Neither outlet reports access to another user’s data or privilege escalation.

Fog Security suspects a state-management flaw involving image generation, safety interruptions and artifact cleanup. Both outlets say this is a hypothesis and not a confirmed root cause.

Reported timeline:

  • June 25, 2026: Fog Security reported the issue through Google’s Vulnerability Reward Program. Google first classified it as out of scope, then resumed analysis after the researchers stressed it was an infrastructure issue rather than model behavior (both outlets).
  • July: the report reached the product team (GBHackers).
  • September: Google decided not to track it as an abuse bug. Cyber Security News dates this September 30; GBHackers says only September.
  • October 15: rejected images from earlier conversations could still be retrieved (GBHackers).
  • October 22: those conversations downloaded the expected images, and 12 new attempts did not reproduce the issue (both outlets).
  • October 23: per Cyber Security News, Google said no internal ticket had been filed and closed the report.

Google attributed the change to routine maintenance, not to a fix linked to the report. GBHackers adds that Google gave no implementation date.

Testing covered a copyrighted character, a synthetic person and the researcher’s own likeness. Child-safety content and images of other real people were not tested, so the findings say nothing about those categories. Cyber Security News also notes a December 2025 Google community report of downloads returning older images, but says it did not establish a safety bypass.

Am I affected?

  • Gemini users: the sources report no user-side exposure and no action for end users. Behavior stopped reproducing on October 22, 2026. Whether a permanent fix exists is not confirmed, since Google called the change routine maintenance.
  • Teams building AI image features: the reported pattern is relevant to you. A refusal in the chat does not help if a separate download or storage path serves a different, rejected artifact.
  • CVE: none is mentioned in the sources. Exploitation in the wild is not reported.

What to do now

  1. Review every path through which generated images are delivered (inline preview, full-size download, stored files) and confirm they all follow the same safety decision.
  2. Bind each download to the specific approved image shown to the user, as Fog Security recommends.
  3. Remove stored artifacts from refused or failed generations, as Fog Security recommends.
  4. Include stored files and download links in AI safety testing, not only chatbot replies (Cyber Security News).
  5. Retest after any maintenance or infrastructure change. The Gemini behavior changed without a confirmed fix, so do not assume the issue is permanently resolved.

Sources