Researchers Find OpenAI Google Image Models Easily Tricked Into Nudes

OpenAI Google image models safety bypass

Safety researchers at White Circle have shown that the latest image generators from OpenAI and Google fold under pressure with surprising ease, coughing up explicit material despite their built-in guardrails. The details landed in a preprint last month and are headed for NeurIPS 2026 this November. Using nothing but off-the-shelf tools and public models, the team punched holes in DALL·E 3, Google's Nano Banana 2, and GPT-Image-2. In the worst case, about thirteen percent of attack prompts sent to DALL·E 3 produced images human reviewers flagged as explicit. Nano Banana 2 dipped below ten percent, and GPT-Image-2 hovered around three, but White Circle stressed these are the highest bypass rates they've ever clocked under their testing standard.

RISE red-teaming method explained

The method, called Red-teaming via Iterative Strategy Evolution (RISE), doesn't lean on custom frontier systems. Instead, the researchers grabbed a version of Qwen3-32B with its safety training stripped away-downloaded straight from Hugging Face-to cook up jailbreak prompts. A separate judge model, Gemini 2.5 Flash, then verified if the outputs crossed the line. Denis Shilov, White Circle's chief executive, told Ars Technica the approach proves you don't need a cutting-edge model to break a cutting-edge model. The whole pipeline runs on widely available parts, and they plan to open-source it so model makers can see the true scale of the vulnerability.

What makes this especially troubling is the trajectory. White Circle tested newer releases-ChatGPT Images 2.5 and Nano Banana 2.1-using the same playbook and found both significantly more breakable than their predecessors. Shilov offered two working hypotheses: either the newer models are just more sophisticated and capable of a wider range of content, or safety took a back seat to raw capability. Neither OpenAI nor Google responded to requests for comment on the original findings or the follow-up tests.

AI safety guardrails implications beyond nudes

The implications stretch way beyond explicit imagery. If leading labs struggle to contain a category that seems straightforward to detect, the outlook for blocking complex harms-like code for cyberattacks or instructions for physical violence-looks precarious. White Circle research engineer Dmitrii Kharlapenko noted that red-teaming image generators remains poorly calibrated, with virtually no papers establishing shared norms. That vacuum lets companies claim progress without meaningful external verification.

White Circle sits in an unusual spot in the ecosystem. Founded after Shilov published one of the most widely cited universal jailbreaks in October 2024, the public benefit corporation counts senior figures from Anthropic, DeepMind, Hugging Face, and OpenAI among its backers. Its mission is to stress-test advanced systems before malicious actors do. The org has shared findings with frontier labs through mutual contacts and is in early talks with government officials about mandatory third-party safety audits. Shilov argues independent evaluation should be required, not voluntary, because most AI firms pour the bulk of their resources into compute and infrastructure while safety testing takes a back seat.

Developer takeaways AI provider safety layers

For developers and product teams building on these models, the takeaway is practical: you can't assume the provider's safety layer will hold under determined probing. If your app surfaces image generation to end users-especially where non-consensual explicit content could cause real harm-you need extra guardrails. Think content classifiers downstream of the API, rate limits on prompt variations, and logging that flags repeated jailbreak patterns. Teams should also keep an eye on the NeurIPS presentation and the forthcoming open-source release of the RISE pipeline, since the same iterative technique could be adapted to probe other prohibited categories.

The broader lesson? Safety doesn't automatically improve with capability. As models grow more powerful, the attack surface expands. White Circle's work suggests that without sustained, independent pressure-and maybe regulatory mandates-the gap between what models can do and what they can be prevented from doing will keep widening. Builders who treat provider safeguards as a finished solution rather than a moving baseline risk shipping products that fail when adversaries inevitably show up.

Source: Ars Technica