Google faces another security headache with its Gemini AI assistant. A bug in Android 16 lets anyone with physical access to a locked phone send SMS messages or even WhatsApp texts without entering the device PIN. The issue surfaced in reports as early as May. It highlights persistent challenges in balancing AI convenience against basic authentication safeguards.
Researchers first flagged similar problems in September 2025. This latest variant feels distinct. It exploits a precise multi-touch gesture. The flaw doesn’t require remote exploits or sophisticated tools. Just hands on the device. And a well-timed button press.
Picture the scenario. Your phone sits locked on a table. A thief or nosy acquaintance picks it up. With Gemini enabled on the lock screen, they open the assistant. They request to send a text. If access to the Messages app has been revoked for Gemini, the system prompts to continue and unlock. But press “Continue” at the exact same instant as Gemini’s “Add attachment” button. Authentication collapses. The message flies out. No PIN required.
From there the problems compound. Users can type commands like “@WhatsApp” into the Gemini prompt. This silently re-enables previously disconnected apps. The connections stick even after the phone unlocks. Check the settings later. WhatsApp shows as linked to Gemini. As if the owner had approved it all along. The Digital Trends article detailed this flow with video evidence. It demonstrated the bypass in action on affected devices.
Google confirmed the bug. A spokesperson told The Register it was known. The company implemented a fix. Deployment was scheduled for this week as of July 17. “This is a known bug and it has already implemented a fix that was scheduled for a full deployment this week,” the spokesperson said. The patch should arrive via server-side update or system update. No word yet on exact rollout timing for all carriers.
Not every device behaves the same. Some users couldn’t reproduce the bug on Samsung handsets. The issue appears tied to phones running Android 16 with Gemini lock screen access turned on. It is not limited to Pixel models. “The bug is not Pixel-specific,” the Google spokesperson added in the same Register report. Yet the company stopped short of listing exact vulnerable manufacturers or models. That leaves many users guessing.
The implications stretch beyond simple texts. Attackers could impersonate owners. Send scam messages to contacts. Or worse in theft cases. UK police have noted rising phone snatch incidents where thieves use devices to request money via SMS before victims can react. A convincing text from a “friend” in trouble could open doors to fraud. Bitdefender’s analysis echoed these risks. It stressed that physical access scenarios remain common for unattended or snatched phones.
One researcher reproduced an earlier version of the flaw on a patched Pixel 6a. They used Gemini’s Deep Research feature as the entry point. That write-up appeared on Infosec Writeups back in May. It showed the patch from previous reports wasn’t enough. The Bitdefender Hot for Security post referenced this work. It warned that every new Gemini capability on the lock screen creates another potential attack surface.
Android Headlines covered the story too. Their July 17 piece noted the bug allows not just texts but phone calls in some reports. It differentiated this from the 2025 incidents. “These reports appear to be different from the similar Gemini Android lock screen bypass bugs from September 2025,” the article stated. Sai Krishna’s reporting for Android Headlines highlighted the fix timeline. It could land as early as that same week.
Until the update hits devices, users have workarounds. Open the Gemini app. Tap the profile picture. Head to Settings. Select “Gemini on lock screen.” Turn off “Use Gemini without unlocking” entirely. Or at minimum disable “Make calls and send messages without unlocking.” Google support pages outline these exact steps. They provide a quick shield while the broader fix propagates.
This isn’t the first time AI integration has exposed cracks in mobile security. Gemini’s lock screen features promise quick access. Ask for directions. Draft a reply. Make a call. All without unlocking. Convenience drives adoption. But it also expands the trusted computing base. The assistant gains privileges normally gated behind authentication. When those privileges leak through timing quirks or gesture exploits, trust erodes fast.
Industry observers point to broader lessons. AI assistants on mobile need hardened boundaries. Especially at the lock screen. Testing must simulate physical attack models more aggressively. Timing-based bypasses like the simultaneous button press should have been caught earlier. Multiple reports since May suggest the bug lingered. Even after prior fixes for related issues.
Google moves quickly now. The company acknowledges the problem. It pushes the patch. Yet the episode adds to a pattern. Earlier Gemini lock screen bypasses drew similar headlines. Each time the response involves tighter controls or updates. Users wonder if fundamental design choices around always-available AI need rethinking.
For enterprise IT teams the flaw carries extra weight. Corporate phones often enable Gemini for productivity. Lock screen access boosts efficiency. It also creates shared risk in shared environments. A lost device in an office could leak more than intended. Messages sent under false pretenses might compromise business relationships or trigger compliance violations.
Consumers face the immediate hassle. Disable a feature they might enjoy. Wait for the update. Check settings afterward to ensure no unauthorized app links appeared. The persistence of the bypass makes post-incident verification necessary. Unlock the phone. Review connected services. Revoke anything suspicious.
Recent discussions on X amplified the warnings. Users shared reproduction steps. Others reported success on specific Pixel models running the latest Android 16 beta or stable builds. Threads called for faster server-side mitigations. Some questioned why Gemini needs lock screen texting powers at all. The conversation echoes older debates around Siri and Google Assistant shortcuts. Convenience versus control.
Security researchers will likely dissect the fixed code once available. They may uncover why the multi-touch race condition evaded initial reviews. Was it a UI layering issue? A race in the authentication handler? Details could inform future AI-mobile integrations at other vendors. Apple faces parallel pressures with Apple Intelligence features. Any always-on assistant invites scrutiny.
Google’s track record shows it patches aggressively. Monthly Android security bulletins address dozens of flaws. This one earned attention because of its simplicity. No code execution. No zero-day chain. Just a gesture and a prompt. Effective enough to matter in real-world thefts or opportunistic attacks.
The fix can’t come soon enough. Android fragmentation means not every device receives updates at the same pace. Older flagships or budget models on Android 16 might lag. Carriers and OEMs add another layer of delay. Google says the update deploys this week. But “this week” can stretch depending on the channel.
In the meantime the advice stays simple. Limit Gemini on the lock screen. Treat physical access as a real threat vector. It always has been. This bug just makes the consequences more visible. A stolen phone shouldn’t double as an open microphone to your contacts.
Expect more scrutiny on AI lock screen features going forward. Developers will audit gesture handlers and prompt flows with fresh eyes. Users will demand clearer toggles and better defaults. The incident serves as a reminder. Innovation in AI must walk in step with hardened security. Otherwise the features meant to help become the vectors that harm.
Google’s rapid response buys some goodwill. The company caught the reports. It built and scheduled the fix. Yet the existence of repeated bypasses suggests deeper architectural questions remain. How much should an AI see and do before the phone unlocks? Where does the authentication boundary sit? These debates will shape the next generation of mobile assistants.
For now owners of Android 16 devices should act. Check their Gemini settings today. Disable the risky permissions. Watch for the update notification. And stay alert if the phone leaves their sight. A few taps now prevent unwanted messages later. The AI can wait until the screen unlocks.
WebProNews is an iEntry Publication