OpenAI, Google pushing new AI models easily tricked into making nudes, researchers say

Safety researchers at White Circle, a public benefit corporation, report that a jailbreak method they call RISE bypassed filters on DALL·E 3, Google’s Nano Banana 2, and GPT-Image-2 using widely available models and ordinary API calls. Ars Technica reports they measured successful generation of banned explicit content about 13% of the time—the highest rate of any method they tested under the same standard.

White Circle told Ars that follow-up tests on newer releases—ChatGPT Images 2.5 and Nano Banana 2.1—found both significantly more breakable than prior versions. Neither OpenAI nor Google responded to Ars on the findings. The group plans to present the work at NeurIPS 2026 and open-source the attack pipeline so labs and policymakers can see the scale of the gap.

This lands against a grim backdrop. Google co-authored research this summer finding non-consensual AI sexual imagery often travels in private messages and clouds where reporting is rare. The Internet Watch Foundation said it found more photorealistic AI-generated child sexual abuse images in the first half of 2026 than in all of 2025.

We’re not impressed by capability demos that outrun the filters meant to keep the worst material offline. If White Circle’s numbers hold, the story is simple: the most accessible image models from two of the biggest labs still leak under automated pressure that does not require a frontier attacker.

The method matters as much as the rate. RISE pairs an attacking model with a judge model and iterates strategies that transfer across prompts and systems. White Circle says the attacker was a Qwen model from Hugging Face and the judge was Gemini 3.8 Flash—neither exotic. That undercuts the comfort story that only specialists can break these systems. When the barrier is “download and call an API,” the intervention point Google’s own research called most critical—blocking generation at the source—is failing in practice.

Labs will say they patch continuously and that absolute blocks are hard. Fair enough. What’s harder to defend is shipping newer, more capable image models that outside testers say are easier to break than the last ones. White Circle’s working hypothesis is either capability is outrunning safety, or safety is being deprioritized. From where we sit, those are not mutually exclusive.

Independent evaluation is the through-line. Bug bounties that only cover the lab’s preferred failure modes, and NDAs that keep critical findings quiet, do not substitute for public third-party testing. We’re for useful generative tools. We’re also for friction that makes non-consensual and illegal imagery expensive to produce. If voluntary self-assessment keeps publishing green lights while external groups keep finding red ones, mandatory independent audits stop looking optional.

Text-to-image models from major labs advertise safety filters against explicit and illegal content. Outside red-teamers have repeatedly shown those filters can be bypassed, while advocacy groups report rising volumes of AI-generated abusive imagery.