White Circle researchers used widely available tools to bypass safety filters in OpenAI and Google image models, generating explicit content in up to 13% of tests.
Safety researchers at White Circle, a public benefit corporation, have demonstrated that leading AI image generators from OpenAI and Google can be tricked into producing explicit content using widely available tools. The findings, detailed in a preprint and reported by Ars Technica, suggest that as AI models become more capable, their defenses against generating banned content may be weakening.
White Circle developed an attack strategy called "Red-teaming via Iterative Strategy Evolution" (RISE). The method uses two components: an attacking model that generates jailbreak prompts and a judge model that verifies if the output contains banned content. According to the researchers, the entire pipeline relies on publicly available models, including a version of Qwen3-32B with safety training removed and Gemini 2.5 Flash as the judge.
"You don't need to have frontier models to break defenses of a frontier model, which is very interesting," Denis Shilov, CEO of White Circle, told Ars Technica.
The researchers tested several models, including DALL·E 3, Google’s Nano Banana 2, and GPT-Image-2. In the best-case scenario for the attackers, about 13 percent of prompts sent to DALL·E 3 produced images confirmed as explicit by human reviewers. The bypass rate was under 10 percent for Nano Banana 2 and about 3 percent for GPT-Image-2. White Circle stated that "none of these requests required custom-built or frontier AI models."
White Circle also tested newer versions of these models, specifically OpenAI's ChatGPT Images 2.5 and Google's Nano Banana 2.1. The researchers told Ars Technica that both new models were "significantly more breakable than their previous versions." Neither OpenAI nor Google responded to requests for comment on these specific findings.
Shilov suggested two possible explanations for this trend: either the newer models are more sophisticated and capable of generating a wider range of content, or safety has been deprioritized in favor of capability. White Circle plans to present these findings at the NeurIPS 2026 conference in November and intends to open-source the attack pipeline to help developers build stronger protections.
The research highlights a growing concern regarding non-consensual intimate images (NCII) and child sexual abuse material (CSAM). A Google co-authored study from July 2026 found that much of this content is shared in private channels, making detection difficult. The study concluded that the "most critical intervention point" remains at the source: the AI tools used to create the images.
The Internet Watch Foundation (IWF) reported that its analysts found 6,310 AI-generated images meeting the legal definition of CSAM in the first half of 2026, a figure about 40 percent higher than the total for all of 2025. An IWF spokesperson told Ars Technica that "urgent action was needed" and called for regulators to introduce a safety framework requiring AI companies to prevent their technology from being used to generate such material.
The demonstration that off-the-shelf tools can bypass safeguards in major AI models challenges the assumption that only sophisticated, custom-built attacks pose a threat. It underscores the difficulty of maintaining effective content filters as models grow more capable. White Circle argues that mandatory independent audits and third-party monitoring are necessary, as current self-assessments by AI labs may not fully reveal vulnerabilities. The release of the RISE pipeline could accelerate the discovery of weaknesses but also risks providing malicious actors with a roadmap for bypassing safety measures.
Sources
This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.
The day's checked news, by email
One short email a day with the top stories. Free, and you can unsubscribe in one click.
Or follow for the latest news:
No comments yet. Start the discussion.
Microsoft introduced new security features to monitor AI agents, warning that autonomous systems can pose insider risks even without being hacked. The company urges separating intelligence supply from control authority.
The Department of Homeland Security has ordered federal civilian agencies to remove DeepSeek AI products from IT systems and barred future procurements, citing cybersecurity risks.