Gemini AI Flaw Lets Android Users Bypass Lock Screen and Access Calls, Messages

A new security vulnerability has emerged for Android users involving the Gemini artificial intelligence application developed by Google. This flaw enables anyone holding the phone to bypass the lock screen and gain access to core device functions, including making calls and sending messages, without needing the password or facial recognition.

A report by the British technology website The Register revealed that this weakness grants attackers broad permissions, effectively turning the phone into an open gateway in cases of theft or loss.

How the Vulnerability Operates on Android 16

The report detailed the exploitation method used by individuals on the new Android 16 system. Normally, the app requests a password when attempting to access sensitive data from the lock screen, but the flaw allows Gemini to automatically bypass this security measure.

This vulnerability permits the user to make phone calls, send SMS messages, and even dispatch WhatsApp messages directly while the phone remains completely locked.

The exploit activates when pressing the continue button alongside the (+) icon next to the phrase "Ask Gemini" on the lock screen. At this point, the assistant opens permissions without verifying the phone owner's identity.

Risks and Expert Recommendations

Although exploiting this flaw requires physical possession of the device and some time to activate—making remote attacks impossible—experts at Digital Trends warn that the risk significantly increases in scenarios involving stolen phones.

The greater concern lies in Google's ongoing development to transform Gemini into an AI agent with extensive access to all photos, files, and personal applications. This means that any similar future vulnerability could potentially expose the entire phone's data.

In response to these findings, Google issued a statement acknowledging the existence of the flaw and confirmed that an over-the-air (OTA) security update is scheduled for release within the week to address the issue across all affected devices.

Meanwhile, technical specialists advise users to temporarily disable Gemini's permission to appear on the lock screen via phone settings. This precaution aims to prevent exploitation of the vulnerability in case the device is lost or stolen until the security update is installed.