Google Gemini · Disclosed

[Single source] Gemini flaw let users download images blocked by its filters

Nov 09, 2026 · 1 min read

Researcher Jason Kao of Fog Security found that Google Gemini's download feature could deliver images the AI's own filters had blocked, including sexualized and copyrighted content, with no jailbreak required. The chat would display an approved image while the download sometimes served the rejected one. The item does not say whether a fix is available.

By HIFY Radar newsroom Updated 11/09/2026 01:04 PM Get this every day →← Back to the feed 1 source

MediumVulnerabilityDisclosedFix unconfirmed

In 30 seconds

Alleged

A post on X by DarkWebInformer reports that a flaw in Google Gemini allowed users to download AI-generated images that the model's own safety filters had refused to generate. The flaw, attributed to security researcher Jason Kao of Fog Security, allegedly sat in Gemini's download functionality, which sometimes served a previously rejected image - including sexualized and copyrighted content - even while the conversation displayed an approved one, with no jailbreak or prompt manipulation required. Google reportedly declined to track the June 2026 report as an abuse bug, and by October 22, 2026 the behavior could no longer be reproduced, a change Google attributed to routine maintenance.

What happened

Alleged

According to the post, Jason Kao of Fog Security discovered that Gemini's download functionality would sometimes deliver an image the AI had explicitly refused to generate - including sexualized and copyrighted material - even when the conversation on screen displayed a different, approved image.

Alleged

Kao reported the issue to Google in June 2026, per the post, and the company declined to track it as an abuse bug. By October 22, 2026, researchers could no longer reproduce the behavior, and Google attributed the change to routine maintenance.

Why it matters

Inferred

If the account is accurate, the flaw represents a category of AI safety failure that is easy to underestimate: the guardrail appeared to work - the conversation showed a compliant image - while the underlying download served content the filter had rejected. Because no jailbreak or prompt manipulation was required, ordinary use of the download function could allegedly surface sexualized and copyrighted content the system was built to block.

Inferred

The episode also illustrates the disclosure gray zone around AI safety bugs: Google's reported refusal to track the issue as an abuse bug would have left a safety-relevant flaw outside the process typically reserved for security vulnerabilities.

What to do

Observed

The report offers no remediation guidance for users or administrators, and the evidence batch contains no vendor advisory, patch note, or user-facing instruction; the only documented actions are the researcher's June 2026 report to Google and Google's handling of it. Readers should treat claims about the flaw as unverified pending a primary write-up or a Google comment.

Confirmed and still uncertain

Alleged

Reported as known: the flaw involved Gemini's download functionality; it could return images the AI had explicitly refused to generate, including sexualized and copyrighted content; it required no jailbreak or prompt manipulation; it was reported to Google in June 2026; Google declined to track it as an abuse bug; and by October 22, 2026 it could no longer be reproduced.

Inferred

Unknown from the available evidence: the technical root cause, how long the behavior existed or how often it occurred, whether any real users actually retrieved blocked images, whether the 'routine maintenance' was in fact a deliberate fix, and whether any bounty or coordinated disclosure followed. No primary research write-up or Google statement appears in the batch.

What people are saying

Alleged

Jason Kao of Fog Security is credited with discovering the flaw, according to the post. DarkWebInformer, the account that surfaced the claims, framed the episode in alert style as a safety bypass that let users download images Gemini's own filters had blocked.

Alleged

Google, as characterized in the post, took the position that the issue did not merit tracking as an abuse bug, and later attributed researchers' inability to reproduce the flaw to routine maintenance rather than a targeted fix.

Evolution

Alleged

Reported timeline: June 2026 - Jason Kao of Fog Security reports the download flaw to Google, which declines to track it as an abuse bug. October 22, 2026 - researchers can no longer reproduce the issue, which Google attributes to routine maintenance.

Observed

Public disclosure appears to begin with the DarkWebInformer post published on X on November 9, 2026; no earlier public discussion of the flaw is present in the evidence batch.

Reach

Observed

1 independent groups, 1 updates, and 1 engagements.

Technical detail

Alleged

The described mechanism is a mismatch between what Gemini displayed and what it served: the conversation rendered an approved image while the download functionality delivered a previously rejected one, including sexualized and copyrighted content. Crucially, the post states the bypass required no jailbreak or prompt manipulation, distinguishing it from the more common prompt-injection class of filter bypasses.

Sources and evidence

Observed

This brief rests on one untrusted, secondary source: a post on X by DarkWebInformer (x:2119823125445476651), published November 9, 2026, summarizing research attributed to Jason Kao of Fog Security. No primary advisory, Fog Security write-up, Google statement, or independent confirmation is present in the batch, so every factual claim above - including Google's alleged response - rests solely on this post and should be treated as unverified.