White Circle says jailbreaks beat OpenAI and Google image models' nude filters about 13% of the time

Safety researchers at White Circle, a public-benefit corporation, told Ars Technica in a story published October 14 that their "Red-teaming via Iterative Strategy Evolution" (RISE) method bypassed safeguards on leading text-to-image models and generated explicit content about 13% of the time—"the highest of any method tested under the same standard," the group said.

A preprint published last month covered flaws in DALL·E 3, Google's Nano Banana 2 and GPT-Image-2. White Circle told Ars that the same method applied to newer ChatGPT Images 2.5 and Nano Banana 2.1 releases showed both are "significantly more breakable than their previous versions." Neither Google nor OpenAI responded to Ars' requests for comment on the findings.

White Circle CEO Denis Shilov said the pipeline uses widely available models—an attacking Qwen model from Hugging Face and Gemini 3.8 Flash as a judge—so "you don't need to have frontier models to break defenses of a frontier model." The group plans to open-source the attack pipeline and present the work at NeurIPS 2026 in November.

The Ars report also cited an Internet Watch Foundation warning that analysts found more photorealistic AI-generated child sexual abuse images in the first half of 2026 than in all of 2025, including 6,310 AI images meeting the legal definition of CSAM—about 40% higher than last year's total. White Circle argued that governments should push for independent third-party evaluation rather than labs assessing their own safety.