Gemini lock screen bug allows anyone to send texts without unlocking your Android phone

How does the flaw work?

The exploit only works under some very specific conditions, and requires you to have revoked Gemini’s access to certain apps, such as Messages. Once that’s true, asking Gemini to send an SMS from the lock screen leads to a prompt to open the app necessary for the action. Tapping “Continue” will then make the phone ask you to authenticate or enter a PIN to access the app. 

This safeguard can be easily bypassed by pressing “Continue” simultaneously with Gemini’s “Add Attachment” button. If you do that, the device sends the text message via Gemini without ever requiring the PIN or authentication.

It only gets worse from there, as other apps can be reconnected with Gemini only by typing in the AI’s text field, without ever needing a PIN. For example, you can enter “@WhatsApp” in the Gemini window, and that will give it access to Meta’s messaging app without going through the proper authentication process.

How much of a risk is this Gemini bug, and how do you protect yourself?

While this is a severe issue, it still requires someone to have physical access to your device, which makes it less likely to turn into a major issue. However, if your phone gets stolen, it could allow thieves to scam people from your phone number, which could easily turn into much more of a problem.

For the time being, your best line of defense is to entirely disable Gemini’s lock screen access on your Android smartphone, at least until Google’s promised software update lands. 

AI skeptics on Reddit have already wondered who even has Gemini active on their phone, but having a voice assistant is still valuable to some users. One commenter has shared they’re using it to put timers and control their home devices on a daily basis.

Unacceptable miss from Google

Putting my feelings about AI aside, I can’t overlook the fact that its implementation feels sloppy and rushed to an unacceptable extent. I’m fine with some fun, broken test features here and there, but backdooring my phone’s lock screen to make using Gemini easier is crossing a boundary that’s too important.