Researchers Say a 13% Bypass Rate: Off-the-Shelf Tools Still Break OpenAI and Google Image-Model Filters

The safety filters on leading AI image generators are weaker than the companies behind them suggest, according to research reported Tuesday by Ars Technica. White Circle, a public benefit corporation backed by senior figures from Anthropic, DeepMind, Hugging Face and OpenAI, says its automated attack method bypassed the explicit-content guardrails on OpenAI's DALL-E 3 and GPT-Image-2 and on Google's Nano Banana 2 in about 13% of attempts — using only tools anyone can download and ordinary API calls, with no AI expertise required.

The method, named RISE — Red-teaming via Iterative Strategy Evolution — was described in a preprint published last month. Rather than refining one prompt at a time, RISE searches for strategies that keep working across different requests and different models. It pairs two AI components: an attacker, built on a Qwen model downloaded from Hugging Face, which generates jailbreak attempts, and a judge, Gemini 3.8 Flash, which checks whether the target model actually produced banned content. Human reviewers then verified the outputs.

White Circle calls the roughly 13% bypass rate the highest of any method tested under the same standard, and stresses that no custom-built or frontier model was needed. "You don't need to have frontier models to break defenses of a frontier model," CEO Denis Shilov told Ars Technica, calling the results "horrifying."

The picture gets worse with the newest releases. White Circle told Ars Technica that OpenAI's ChatGPT Images 2.5 and Google's Nano Banana 2.1 — both shipped after the research — are "significantly more breakable than their previous versions" when tested with the same method. Its working hypothesis: the newer models are either more capable of generating a wider range of content, or safety has been deprioritized in favor of capability. Neither OpenAI nor Google responded to requests for comment on either set of findings. Midjourney was not tested because it offers no public API suitable for controlled benchmarking.

The explicit-content category was chosen deliberately, because it should be among the easiest for automated filters to catch. Shilov's argument is that if frontier labs cannot keep explicit imagery out of a well-defined, detectable category, their defenses against harder-to-detect abuses — malware generation, hacking assistance — are unlikely to hold either. The backdrop is grim: the Internet Watch Foundation reported this month that its analysts assessed 6,310 AI-generated images meeting the legal definition of child sexual abuse material in the first half of 2026, about 40% more than in all of 2025.

A separate study co-authored by Google researchers adds demand-side data: among users who admitted creating AI-generated nude images, 20% said they did it "for fun" or "as a joke" and nearly a third said they were experimenting with the technology. That research argued the generation tools themselves are the most critical intervention point, since harmful material can then move through private messages and cloud storage where detection is harder.

White Circle plans to publish the full RISE pipeline on GitHub and present the work at NeurIPS 2026 in November. It says it shared findings with some frontier labs through mutual contacts, and Shilov is in early talks with government officials about making independent third-party safety testing mandatory. There is friction in that direction: on Tuesday, Reuters reported that OpenAI and Anthropic urged that external evaluators be bound by restrictive NDAs to prevent leaks of trade secrets — a position that sits awkwardly with calls for independent audits. Shilov's own experience with Anthropic's bug bounty, which he described as "very constrained in its purpose," is part of why White Circle went public instead.

The 13% figure describes White Circle's own test setup, not the odds that an ordinary user's prompt slips through, and it says nothing about how the same method would fare against graphic violence or self-harm filters. What it does establish is that reusable, transferable jailbreaks can be found cheaply and without frontier compute — which shifts the argument from whether independent adversarial testing is needed to who is allowed to run it.