Safety researchers at White Circle say a prompt attack got past safeguards in image models from OpenAI and Google. The group also told Ars Technica that two newer releases, ChatGPT Images 2.5 and Nano Banana 2.1, were “both significantly more breakable than their previous versions” when tested with the same method.
In a preprint published last month, White Circle tested DALL·E 3, Google’s Nano Banana 2, and GPT-Image-2. Human reviewers confirmed explicit images from about 13 percent of attack prompts sent to DALL·E 3. The rate was under 10 percent for Nano Banana 2 and about 3 percent for GPT-Image-2. White Circle said the DALL·E 3 result was the highest human-verified rate among methods tested under the same standard.
White Circle calls its method Red-teaming via Iterative Strategy Evolution, or RISE. It develops reusable attack strategies and uses them to generate varied prompts, rather than rewriting one harmful prompt at a time. The attacking model is a publicly available version of Qwen3-32B with its safety training removed. Gemini 2.5 Flash serves as the judge model. The tests used downloadable tools and API calls, White Circle said.
The researchers tested newer models
White Circle did not give Ars bypass rates for ChatGPT Images 2.5 or Nano Banana 2.1. It said only that both were significantly more susceptible to the same method than the earlier versions it tested. Neither OpenAI nor Google responded to Ars’ requests for comment on the findings.
The results matter because safeguards on widely available image tools can add friction for people trying to create nonconsensual sexual images. A Google co-authored study of Internet users in the United States, Australia, and the United Kingdom found that such images often circulate in private messages or cloud storage, where detection is harder. The study identified the tools used to create them as a critical point for intervention.
The Internet Watch Foundation has also warned about AI-generated child sexual abuse imagery. Its analysts found 6,310 AI images meeting the legal definition of child sexual abuse material in the first six months of 2026, about 40 percent more than its total findings for 2025. The UK-based charity called for a safety framework requiring AI companies to prevent their tools from generating such material.
Read nextOpenAI alleges former employee shared product plans with AppleWhite Circle calls for outside testing
White Circle CEO Denis Shilov told Ars that independent safety audits should be mandatory. The group has shared its findings with some frontier AI labs through mutual contacts and is in early talks with government officials about third-party testing. White Circle says RISE could also help test safeguards against other banned images, including depictions of graphic violence or self-harm.
White Circle plans to publish the attack pipeline on GitHub so others can examine the method. It also plans to present the research at NeurIPS 2026 in November.
