Google’s Gemini Exposes Weakness in Safety Infrastructure: Download Links Reveal Forbidden Images
On November 5, 2026, a significant finding regarding Google’s Gemini AI was disclosed by Jason Kao, a researcher from Fog Security. The investigation revealed that the AI system inadvertently exposed images that had been blocked by its safety filters through download links, pointing to a critical infrastructure flaw. This incident raises questions about the efficacy of safety measures implemented in advanced AI applications.
Kao’s research demonstrates a curious behavior within the Gemini system: while it could effectively deny certain image requests, the underlying infrastructure still made these blocked images available for download. Through a series of testing conducted on October 22, the researchers observed a change in Gemini’s behavior; twelve attempts to replicate the initial issue failed, suggesting that Google may have altered the system’s functionality in response to the findings.
The implications of this research are profound. It highlights a disconnection between the safety protocols governing content delivery and the conversational decisions made by the AI. Unlike traditional AI jailbreak methods, which encourage the model to sidestep its restrictions, this case demonstrated that Gemini’s refusal to process specific requests remained intact. However, the surrounding application failed to consistently enforce these restrictions, thereby allowing access to previously rejected outputs.
Download Links Served Different Artifacts
According to Fog Security’s findings, Gemini’s web application had an intriguing flaw: it exposed generated images via separate inline viewing and download paths. Instead of ensuring that both the displayed image and the downloadable file reflected the same approved artifact, the system sometimes returned earlier images that had triggered safety refusals. This inconsistency raised alarms about the integrity and security of the AI’s image management approach.
In one instance, researchers submitted an image request that activated Gemini’s safety protocols and then subsequently requested a different, permissible image. While the visible conversation displayed the permitted result, the underlying download mechanism retrieved the previously blocked image. The nature of the returned files varied widely, ranging from incomplete or blurry artifacts to fully formed images. This irregularity was replicated across multiple testing sessions over several days, indicating a persistent vulnerability within the system.
Both the inline image URLs and download URLs utilized the domain lh3.googleusercontent.com and were tied to the signed-in user’s account. Notably, inline image links ended with =s1024-rj, while download URLs used =s0-d-I. Researchers indicated that these links did not function in incognito sessions, and there were no reports of cross-user data exposure or privilege escalation.
First theorized was a potential state-management flaw related to the image generation process. The hypothesis suggests issues with safety interruptions and artifact cleanup. However, this remains unconfirmed and requires further investigation.
Reporting and Response
Fog Security took the steps to report the vulnerability through Google’s Vulnerability Reward Program on June 25, 2026. Initially, Google classified the report as out of scope; however, after further clarification indicating that the issue stemmed from infrastructure rather than model behavior, the investigation was resumed. After being forwarded to the product team in July, the issue was not tracked as an abuse bug, despite its considerable implications for user safety.
The situation remained complex, as researchers confirmed that on October 15, they could still access rejected images from previous conversations. By October 22, the system appeared to have undergone maintenance—successful downloads of expected images were observed, and prior behaviors could not be replicated in subsequent testing.
Google acknowledged that routine maintenance had addressed some issues but did not specify when these changes were implemented. Furthermore, the company stated that there was no internal ticket related to the report, indicating a lack of proactive measures taken prior to the disclosure.
The research encompassed various specific image prompts, including a copyrighted character and a synthetic person, while deliberately avoiding categories related to child safety and actual third-party subjects. This limitation emphasizes the need for extensive testing across different types of prohibited content.
Conclusions and Recommendations
Fog Security’s findings underscore critical lessons about AI-driven safety protocols. Unlike multistep semantic-chaining attacks, which require advanced filtering, the Gemini incident revealed that simply enhancing filters would not suffice to address the issue of mismatched delivery paths. Researchers recommend that Google implement measures to bind downloads to displayed, approved images and to thoroughly eliminate artifacts from any failed or refused generations. The overarching need outlined in the findings is the consistent enforcement of safety protocols across all accessible content rather than merely issuing refusals within conversational interfaces.
As AI technologies continue to evolve, the importance of rigorous examination and consistent safeguards against inadvertent data exposure becomes increasingly critical.