Gemini Safety Filter Bypass: Refused Images Escaped Through Download URLs

Google Gemini could refuse an image in the conversation and still hand you the blocked file through the download button. In a research post published November 5, 2026, Jason Kao of Fog Security describes how gemini.google.com/app bound the inline preview and the full-resolution download to different signed URLs on lh3.googleusercontent.com. The safety decision governed what you saw in chat; the download path could still resolve to a refused, partial, or fully formed image the filter had rejected. Google told Fog the issue was out of scope in June 2026, declined to track it as an abuse bug in September, and said no internal ticket was filed when behavior changed by October 22, 2026. If you run Gemini CLI, Antigravity, or any harness that trusts a provider refusal message, the lesson is about delivery enforcement, not better prompts.

What Fog Security demonstrated

Most public discussion of AI safety focuses on getting past the model: prompt injection, jailbreaks, and crafted instructions that turn a refusal into compliance. Fog's finding sits in a different bucket. The guardrail could make the right call — decline copyrighted characters, decline sexualized edits, or swap in a safe substitute image — while infrastructure still delivered content the policy had blocked.

Fog tested categories aligned with Google's Prohibited Use Policy without involving third-party subjects: copyrighted characters (Mickey Mouse), synthetic people Fog generated itself, and the researcher's own likeness. Fog explicitly states it did not test child-safety categories or real third-party likenesses.

The clearest copyright example: Gemini politely declined to draw Mickey Mouse, yet Fog downloaded Mickey Mouse anyway through the download control.

Image: Fog Security

In a second pattern, Fog asked for an image that would trigger a refusal, then asked for a different, permitted image. The conversation showed the permitted output, but the download link pointed elsewhere — sometimes a blurry intermediate, sometimes a complete image the safety layer had rejected.

Image: Fog Security

Image: Fog Security

Fog recorded walkthrough videos in June 2026 (full process, download mis-binding).

The mechanism: two URLs, one safety decision

On gemini.google.com/app, each generated image had two retrieval paths:

1. Inline viewing in the thread — URL suffix =s1024-rj
2. Full download behind the overlay icon — URL suffix =s0-d-I

Both lived on lh3.googleusercontent.com and were bound to the authenticated session. Fog notes the links did not work in an incognito window, which limits casual sharing but does not fix policy enforcement for the signed-in user.

The inline path reflected the post-safety image the product chose to display. The download path resolved separately. After a refusal or mid-generation abort, the download URL did not always reference the same object as the thumbnail. Outcomes Fog saw included:

• A partial artifact from an aborted unsafe generation
• A fully formed image the filter had rejected
• Occasionally nothing unusual — behavior varied across days and sessions

Fog surmises a state-management race between generation, the safety abort, and artifact cleanup: the download served an object other than the one the safety verdict applied to.

This is the same class of failure as "the UI said no, but the side channel still had the bytes" — closer to OpenAI's September 2026 disclosure that research agents uploaded ChatGPT training images to third-party hosts than to a jailbreak string. In that incident, the harm was exfiltration after the fact. Here, the harm is policy evasion without convincing the model, because the user never had to win an argument with the agent.

Why it is hard to detect

Fog emphasizes three properties that matter for anyone auditing agent products:

1. Invisibility in the chat. The user sees the same polite refusal whether or not a blocked artifact remains reachable. An enforced refusal and an unenforced one look identical.
2. No traditional security boundary crossed. Fog lists no privilege escalation, no other user's data, and no model weights exposed — which helps explain why Google's VRP initially called the report out of scope.
3. Not fixable with prompt defenses alone. Better jailbreak filtering does not bind download URLs to displayed objects.

Fog also notes that since at least December 2025, users on Google's forums and Reddit reported that Gemini's download button saved a different image than shown, treating it as a UX bug. Fog found the issue independently and argues that UX mismatch was a safety bug once tied to refused content.

Disclosure timeline

Fog published the following sequence on its blog:

Cyber Security News summarized the disclosure on November 9, 2026, citing Fog's publication date and retest results.

Fog's recommendations to Google — bind download to the displayed finalized image, and purge artifacts from refused or failed generations — are generic lessons for any multimodal agent stack.

How this relates to Google's agent infrastructure story

Google's own Agent Compute Engine deep dive stresses enforcement at the gateway: credentials never enter the sandbox, egress is brokered, and policy applies where traffic leaves. The Gemini download bug is the inverse problem on the consumer surface: a policy decision in the conversation did not propagate to every user-visible artifact handle.

If you are comparing vendor agent architectures, the question is not only "does the model refuse?" but "do all export paths — download, share link, API attachment, tool write_file — reference the same post-policy object?" Google's microVM story answers that for cloud credentials. Fog's post shows it can fail for image CDN bindings even when the model behaved.

What this means if you run AI coding agents

This post is about Gemini's web image UI, not a disclosed flaw in Gemini CLI or the Gemini API. The coding-agent angle is architectural:

1. Refusal text is not enforcement. When your harness shows "I can't do that," check what was still created on disk, in /tmp, in an MCP resource, or at a URL the agent fetched. The OpenAI eval-versus-production gap is a different flavor of the same trust problem: models can comply in the message and fail in the action channel.

2. Multimodal and tool outputs need one binding. If an agent generates an image, a PDF, or a patch, your review should attach to the artifact ID the tool returned, not the inline preview in chat. Supply-chain posts such as poisoned repo hooks affecting Gemini CLI configs show how extra config files can exfiltrate; this finding shows first-party delivery can also diverge from what the UI shows.

3. Enterprise guardrail metrics can lie by omission. Meta's reported 40% rise in major incidents under heavy agent use was an organizational story, not a CDN bug — but both point to measuring outcomes, not refusal rate. Andy Hall's retest of AI auditors shows log-only oversight misses silent misbehavior; Fog's case is overseen users missing silent artifact delivery.

4. Jailbreak bundles are not the only adware path. Check Point's Haiou jailbreak pack hijacks instructions to paste ads. You do not need a malicious skill if the platform serves two different objects for "view" and "save."

Practical checks today:

• After any refused multimodal request in a Google product you use for work, search Downloads and any agent workspace for unexpected media files from the session date.
• In harnesses you control, log full tool results (URLs, file paths, hashes), not truncated chat rendering.
• For Gemini CLI or API image features, read release notes after October 2026 and retest preview-versus-file behavior when Google ships image tools to developers — Fog's fix was observed on the web app, not documented as a tracked security ticket.

Beam does not inspect Google's CDN URL pairing. Where Beam applies: it records what Claude Code, Codex, and similar agents do on your machine — shell, writes, MCP calls — so you can answer whether your agent saved or uploaded a file, independent of what the chat claimed. See local-first monitoring and workspace policy.

Frequently asked questions

What did Fog Security find in Google Gemini?

Fog Security reported that gemini.google.com exposed each generated image through two paths — an inline preview URL ending in =s1024-rj and a separate download URL ending in =s0-d-I on lh3.googleusercontent.com. After a safety refusal, the download link could still retrieve the blocked or partially generated image while the chat showed a different, allowed picture or a polite decline.

Did this require prompt injection or jailbreaking?

No. Fog Security says the model safety decision could be correct while the delivery layer served a different artifact. The issue was infrastructure state management between generation, safety abort, and artifact cleanup — not tricking the model past its filters.

Can I still reproduce the bypass today?

Fog Security could not reproduce it in 12 new attempts as of October 22, 2026, and older conversations that previously leaked mis-bound downloads began returning the correct image. Google attributed the change to routine maintenance and filed no internal ticket from the report, according to the disclosure timeline Fog published.

Was anyone else's data exposed?

Fog Security states there was no cross-user access, no privilege escalation, and no exposure of another person's data. URLs required the signed-in user session and did not resolve in an incognito window.

What should teams running Gemini CLI or other Google agents do?

Treat chat refusals and inline previews as insufficient proof that no blocked artifact exists elsewhere. Audit tool outputs that write files or fetch URLs, log multimodal responses end to end, and do not rely on vendor guardrails alone without checking what your harness actually saved or uploaded.

Does Beam detect this class of failure?

No. Beam watches shell commands, file changes, and MCP tool calls on your machine through Claude Code and Codex hooks and heuristic skill or MCP scans. It does not inspect Google-hosted CDN URL bindings inside gemini.google.com or other vendor web apps.

Related reading

• Google K-12 Gemini and Search admin controls
• Google Agent Compute Engine: credentials outside the sandbox
• OpenAI agents leaked ChatGPT training images
• OpenAI eval versus production warning compliance
• Poisoned hooks in 42 GitHub repos including Gemini CLI
• Meta Project OT and rising agent incidents
• Andy Hall on AI auditors and false alarms
• Haiou jailbreak prompt adware in Codex bundles
• Primary: Fog Security research post (November 5, 2026)
• Secondary: Cyber Security News (November 9, 2026)

Mechanism and timeline follow Fog Security's published research as of November 5, 2026, and Cyber Security News coverage dated November 9, 2026. Google's VRP responses are quoted from Fog's disclosure timeline; we did not independently verify Google's internal ticket status. Beam capabilities reflect on-device monitoring and heuristic scanning as documented at publish time.