Android 16 Gemini Flaw Lets Locked Phones Send Messages

Google’s Gemini assistant is integrated into Android 16 and can handle selected requests from the lock screen, giving users faster access to AI-powered features. That convenience creates a sensitive security boundary: communication tools should remain protected when a device is locked. A bypass could allow an unauthorized person to impersonate the owner, expose private information or use a trusted account to send fraudulent messages.

Researchers found that, under specific conditions, Gemini could be instructed to send an SMS or WhatsApp message from an Android 16 phone without first unlocking the device. Google confirmed the vulnerability and said a corrective update was expected during the week of July 20, 2026. Until the patch is installed, users can reduce their exposure by disabling Gemini’s lock-screen functionality in the device settings.