Critical Android 16 bug let Gemini bypass the lock screen to send messages

A critical security vulnerability in Google Gemini on Android 16 allowed attackers to send SMS and WhatsApp messages from a locked phone, bypassing the lock screen entirely by abusing the assistant's permissions. The flaw is significant because it turns a convenience feature — letting an AI assistant act on voice or contextual commands — into an unauthenticated action path on a locked device.

The incident illustrates a growing category of risk: as AI assistants gain agentic capabilities and broad system permissions, each new capability expands the attack surface. An assistant permitted to send messages 'hands-free' must rigorously enforce authentication state, and this bug shows what happens when that boundary fails. It parallels the week's other AI-security stories — Hugging Face's autonomous-attack disclosure and xAI's Grok Build exfiltration — all pointing at the same theme: agentic AI's permissions are outrunning its security controls.

Because the report comes via a Medium writeup rather than an official Google advisory in the sources, specifics on affected versions, patch status, and exploitation in the wild are limited. Lock-screen bypass flaws are typically high-severity and fast-patched by Google's Android security team, so a fix is likely imminent or already rolling out.

Readers should watch for an official Google security bulletin confirming the CVE and patch, guidance on which Android 16 builds are affected, and whether Google tightens the default permissions granted to Gemini on the lock screen. The broader lesson for the industry: agentic assistant permissions need the same threat-modeling rigor as any privileged system service.