The Wire.AI Security News and Incident Tracker

Threat · curated 17 Jul 2026

Google fixing Android lock screen bug that lets Gemini send SMS without a PIN

First reported infosecwriteups.com

Coverage timeline

discovered infosecwriteups.com primary 17 Jul 2026theregister.com

Single-source incident — first reported, latest, and curated coincide.

Why it matters

The Gemini lock-screen bug shows how an on-device AI assistant can become an authentication-bypass vector, letting anyone with brief physical access impersonate the owner via SMS/WhatsApp and alter security settings without credentials.

Google is fixing an Android 16 lock screen bypass in which Gemini, accessible from the lock screen, can be tricked into sending SMS and WhatsApp messages without a PIN. Pressing Gemini's "Continue" prompt simultaneously with its "Add attachment" button lets an attacker with physical access dispatch messages and re-enable Gemini's access to previously disconnected apps, all while the device stays locked.