A two-finger gesture let anyone holding a locked Android phone send SMS through Gemini, no PIN needed

The Register reported on July 17, 2026 that Android 16's lock screen carried a gesture-based authentication bypass affecting Gemini's messaging integration. When a device owner has disabled Gemini's access to messaging apps, the assistant normally prompts for the device PIN before sending an SMS from the lock screen. Pressing "Continue" at that PIN prompt simultaneously with Gemini's "Add attachment" button skips the check entirely, letting an unauthenticated person holding the phone send an SMS with no PIN at all, and from there type "@WhatsApp" to extend the same bypass to WhatsApp messaging. Google had been receiving reports of the issue since May 2026, with a similar class of lock-screen assistant bypass previously surfacing as early as September 2025. A fix was scheduled for the week of the report.

Why it matters

A lock screen's entire job is refusing action without authentication, so a bug that lets a two-button gesture substitute for a PIN isn't a minor inconvenience, it's the control failing at its one purpose. Voice and chat assistants layered onto a lock screen for convenience keep reopening this exact category of bug, because each new assistant feature is a new code path that has to independently re-implement "don't do this without authentication first" correctly.

If a device you manage or use runs Gemini with lock-screen messaging access enabled, confirm the July fix has landed rather than assuming a routine security patch cycle already covered it, given reports stretched back two months before the public writeup.

Source: The Register