Cases › security breach › LR-2026-0653
Gemini lock-screen flaw lets strangers send messages from locked Android phones
Preliminary Why: Publisher not yet named · subject to change
Status: fix reported
No source states: loss or records, agent tool, could do, deployer, industry.
Severity moderate: test: scope bounded by the stated physical-access requirement; the sources state no count of affected parties
Google's Gemini assistant on Android 16 phones could be used from the lock screen to send SMS and WhatsApp messages without the device PIN. Per press reporting, an attacker with physical access could send texts pretending to come from the owner. The flaw involved a specific multi-touch gesture: pressing Continue together with the Add attachment button let an SMS go out without authentication, and app connections could then be enabled the same way. Google said the bug is known and a fix was scheduled for rollout this week. The report came from Bitdefender, citing The Register, and noted that the settings changes persist after the owner unlocks the phone.
What happened
What was done
“Fix in progress; rollout said to be scheduled this week”
No later incident for Google under this risk on record.
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Sorted by rule from the case's fields; not yet read from the sources.
Controls
HarnessNot effective Fail-closed defaults
Control failure chain
L1 · ModelGoogleModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
Other controls for this risk at this layer, not mentioned in the sources: Safety training and refusal, Cyber and weapons safeguards, Abuse monitoring and account enforcement, Staged or restricted release, Dangerous-capability testing before release, Outside red-teaming, Content safety classifiers, Safeguards kept on in testing, Reasoning monitoring.
L2 · HarnessHarness not namedAgent framework vendor
L3 · ApplicationThe attackerDeployer
The attacker ran the agent; this layer was the attacker's own.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Known flaws patched, Multi-factor sign-in and password policy, Network segmentation, Intrusion and endpoint detection, Backups and recovery, Phishing and fraud filters.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Content safety classifiers | L1 Model | Not stated in sources |
| Safety training and refusal | L1 Model | Not stated in sources |
| Cyber and weapons safeguards | L1 Model | Not stated in sources |
| Dangerous-capability testing before release | L1 Model | Not stated in sources |
| Outside red-teaming | L1 Model | Not stated in sources |
| Staged or restricted release | L1 Model | Not stated in sources |
| Abuse monitoring and account enforcement | L1 Model | Not stated in sources |
| Reasoning monitoring | L1 Model | Not stated in sources |
| Safeguards kept on in testing | L1 Model | Not stated in sources |
| Fail-closed defaults | L2 Harness | Not effective |
| Known flaws patched | L4 Infrastructure / target | Not stated in sources |
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Not stated in sources |
| Network segmentation | L4 Infrastructure / target | Not stated in sources |
| Intrusion and endpoint detection | L4 Infrastructure / target | Not stated in sources |
| Backups and recovery | L4 Infrastructure / target | Not stated in sources |
| Phishing and fraud filters | L4 Infrastructure / target | Not stated in sources |
Similar incidents
Evidence
- What was done Fix in progress; rollout said to be scheduled this week
No source states: what the AI was doing, what it reached or did, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 4 items from the primary sources
What happened, in order
- September 2025 Earlier similar Gemini lock-screen bypass bugs have affected Android since this date.
- May 2026 A security researcher published a write-up reproducing the lock-screen problem on a fully patched Pixel 6a.
- since May The Register received multiple reports of the authentication bypass on Android 16 devices.
Not dated in the sources:
- Google said the bug is known and a fix is scheduled to be rolled out this week.
Show every field, with its source and grade
The AI system
What happened
Impact
LR-2026-0653 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON