Google Gemini exposed images that its safety filters had rejected through download links, revealing an infrastructure weakness rather than a conventional model jailbreak.
Fog Security researcher Jason Kao disclosed the findings on November 5, 2026, describing how Gemini could refuse an image request while still delivering the blocked artifact. Retesting on October 22 found changed behavior, with twelve new attempts failing to reproduce the issue.
The research highlights a disconnect between conversational safety decisions and content delivery. Unlike AI jailbreaks targeting model responses, this technique did not require persuading Gemini to abandon its restrictions. The refusal remained intact, but the surrounding application failed to prevent access to rejected output consistently.
Download Links Served Different Artifacts
According to Fog Security’s disclosure, Gemini’s web application exposed generated images through separate inline viewing and download paths. The displayed image and downloadable file should have represented the same approved artifact. Instead, the download sometimes returned an earlier image that had triggered a safety refusal.
Researchers first submitted an image request that activated Gemini’s safeguards, then requested a different, permitted image. Although the conversation displayed the permitted result, its download control could retrieve the previously rejected image. Returned files ranged from blurry or incomplete generation artifacts to fully formed images, with successful reproductions across multiple days and sessions.
Both delivery paths used lh3.googleusercontent.com and were bound to the signed-in user. Inline image URLs ended with =s1024-rj, while download URLs used =s0-d-I. The links did not resolve in an incognito session, and researchers reported neither cross-user data exposure nor privilege escalation.
Fog Security has raised concerns about a potential state-management flaw related to image generation, safety interruptions, and artifact cleanup. This explanation is currently a hypothesis and has not been confirmed as the root cause. The issue observed was that the download mechanism provided an artifact that differed from the image governed by the visible safety decision.
Fog Security reported the issue through Google’s Vulnerability Reward Program on June 25, 2026. Initially, Google classified the report as out of scope. However, after researchers clarified that the problem involved infrastructure rather than model behavior, Google resumed its analysis. The report reached the product team in July, but in September, Google decided not to track it as an abuse bug.
On October 15, researchers could still retrieve rejected images from previous conversations. By October 22, those conversations successfully downloaded the expected images, and twelve subsequent attempts did not reproduce the original behavior.
Google later explained that the change was due to routine maintenance and did not provide an implementation date, saying no internal ticket had been filed about the report.
The testing included a copyrighted character, a synthetic person, and the researcher’s own likeness. Researchers excluded child-safety categories and real third-party subjects, which limits what the findings can establish about other types of prohibited content.
The case differs from multistep semantic-chaining attacks, stronger prompt filtering alone would not address mismatched delivery paths. Fog Security recommends binding downloads to displayed, approved images and removing artifacts from refused or failed generations. The central requirement is consistent enforcement wherever generated content becomes accessible, not merely a refusal inside the chat interface.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
