Safety researchers at White Circle, a public benefit corporation backed by leaders from major AI labs, have published a preprint showing that leading text-to-image models from Google and OpenAI can be tricked into generating explicit content. Using off-the-shelf tools and standard API calls, the team bypassed safety filters in DALL·E 3, Google's Nano Banana 2, and GPT-Image-2 about 13 percent of the time, according to Ars Technica. The researchers emphasized that no custom-built or frontier AI models were needed to execute the attacks.
The attack method, called Red-teaming via Iterative Strategy Evolution (RISE), generates jailbreaks with an attacking model and verifies outputs with a judge model. Both components are widely available: the attacker is a Qwen model from Hugging Face, and the judge is Gemini 3.8 Flash. White Circle says the pipeline is reusable and transferable across models, and it plans to open-source the entire attack pipeline. The findings are scheduled to be presented at NeurIPS 2026.
White Circle also told Ars that follow-up testing of newer releases—ChatGPT Images 2.5 and Nano Banana 2.1—showed both are 'significantly more breakable' than their predecessors. The team's working hypothesis is that newer models are either more capable and thus generate a wider range of content, or that safety has been deprioritized in favor of capability. Neither Google nor OpenAI responded to Ars's requests for comment on the vulnerabilities.