Safety researchers at White Circle say an automated jailbreak technique bypassed explicit-content controls in several OpenAI and Google image generators about 13 percent of the time. The reported tests used publicly available models, ordinary tools and API calls rather than custom or frontier AI systems.
The result comes from a recently published White Circle preprint described by Ars Technica. Researchers manually reviewed the generated outputs to verify which attempts had defeated the safeguards. White Circle characterized the 13 percent result as the highest achieved by a method assessed under the same standard.
OpenAI and Google did not respond to Ars’ requests for comment on the findings.
RISE searches for jailbreaks that work across prompts
White Circle named the technique RISE, or “Red-teaming via Iterative Strategy Evolution.” It uses two AI components: an attacker that generates jailbreak strategies and a judge that checks whether the target model produced prohibited material.
The attacking component was a Qwen model downloaded from Hugging Face. White Circle CEO Denis Shilov identified the judge model as Gemini 3.8 Flash.
Instead of refining a single prompt for one scenario, RISE looks for patterns that remain effective across different requests and models. This focus on reusable and transferable strategies is intended to reveal broader weaknesses in content controls rather than isolated prompt failures.
The preprint covered three image-generation products:
- OpenAI DALL·E 3
- OpenAI GPT-Image-2
- Google Nano Banana 2
Midjourney was not included because White Circle said it lacks a public API suitable for controlled benchmarking.
White Circle separately applied the same method to ChatGPT Images 2.5 and Nano Banana 2.1. The organization told Ars that both were “significantly more breakable than their previous versions.” That comparison is White Circle’s assessment; the affected companies did not confirm it.
According to White Circle, the tests demonstrate that probing commercial image safeguards does not necessarily require a specialized model or advanced AI expertise. The method still did not succeed on every request: the reported bypass rate was approximately 13 percent under the organization’s test standard.
The practical risk is easier production of prohibited sexual imagery
The tests targeted controls designed to prevent explicit outputs. A successful bypass means a user can obtain material that the image service is intended to reject, despite interacting through its API rather than compromising the underlying infrastructure.
White Circle chose explicit content partly because it considered the category relatively straightforward for automated safety systems to identify. Shilov argued that failures in this area raise concerns about how effectively models can block other prohibited material. White Circle has proposed extending testing to categories such as graphic violence and self-harm imagery, but the reported 13 percent result should not be treated as evidence of equivalent performance in those categories.
The findings have particular relevance to non-consensual intimate imagery. A separate Google-co-authored study of internet users in the United States, Australia and the United Kingdom found that 20 percent of participants who acknowledged creating AI nude images said they had done so “for fun” or “as a joke.” Nearly one-third said they were experimenting with technology.
Google’s researchers identified the generation tools as the “most critical intervention point,” arguing that technical friction can deter at least some potential abusers. They also noted that harmful material can move through texts, direct messages and private cloud storage, making later detection more difficult.
That Google research was separate from White Circle’s evaluation and was not a company response to the RISE findings.
Developers are urged to test beyond built-in refusals
White Circle recommends using automated adversarial testing such as RISE to discover transferable jailbreaks more quickly. For organizations offering or integrating image-generation systems, the findings indicate that built-in refusals should be tested against repeated, adaptive attempts rather than evaluated only with individual prohibited prompts.
Google’s separate research advocated mandatory safeguards, robust model-level guardrails and provenance indicators for synthetic sexual imagery. White Circle has also called for compulsory independent safety audits, with Shilov arguing that external evaluation would reduce reliance on laboratories assessing their own models.
White Circle said it has passed its findings to some frontier AI laboratories through mutual contacts and is in early discussions with government officials about third-party testing. It plans to publish the RISE pipeline on GitHub and present the research at NeurIPS 2026 in November, potentially giving model developers and independent evaluators a common method for testing whether image safeguards withstand reusable jailbreak strategies.
