Security firm White Circle used downloadable tools and open models to attack image generators, bypassing their filters in roughly 13% of cases, and found newer versions even easier to break.
Researchers used a set of public tools to test OpenAI's DALL·E 3 and GPT-Image-2, along with Google's Nano Banana 2. The filters on these image generators were bypassed in roughly 13 percent of cases, producing explicit content.
Getting past the filters is easier than it should be
The attack method is called RISE. It works like an automated question bank: one model keeps rewriting prompts meant to slip past restrictions, while another model judges whether the output breaks the rules.
The attacker is a Qwen model downloaded from Hugging Face, and the judge is Google's Gemini. The researchers' point: getting past frontier defences does not require a frontier model.
White Circle found ChatGPT Images 2.5 and Nano Banana 2.1 both easier to break than their predecessors. The researchers guess either the models are more capable and cover a wider range, or safety has slipped behind capability.
Who grades the safety exam?
Britain's Internet Watch Foundation says it found 6,310 AI-generated child sexual abuse images that meet the legal definition in the first half of 2026, about 40 percent more than last year's full-year total.
White Circle wants mandatory third-party audits. Labs may ask outside evaluators to sign non-disclosure agreements, which White Circle says it will not sign. Right now, safety testing is largely students writing their own exam and grading it.
Why it matters
Right now the safety level of image models can only be taken on the vendors' word, and the same vendors write the test, grade it and publish the results. Without independent retesting, 'we ran safety tests' is a claim nobody outside can check, which bears directly on whether regulators demand third-party audits.
Curated from high-quality sources, with concise summaries and key takeaways.
