OpenAI, Google AI Models Tricked Into Making Nudes: Safeguards Fail in 13% of Tests

Researchers say they have bypassed safeguards in several major AI image generators, producing prohibited explicit images using widely available tools. The findings, reported by Ars Technica on Oct. 14, raise questions about whether AI companies can keep their content filters effective as image-generation models become more capable.

White Circle, a public benefit corporation focused on AI safety, said its researchers bypassed safeguards in OpenAI’s DALL·E 3 and GPT-Image-2, as well as Google’s Nano Banana 2. The group reported that its attack method generated prohibited explicit content in about 13% of test attempts.

That figure reflects its testing setup, not the likelihood that an ordinary user prompt will produce such an image. The researchers used downloadable tools and API calls rather than custom-built or frontier AI models, according to White Circle’s research announcement.

Newer AI Models May Be More Vulnerable

White Circle’s research first appeared as a preprint last month. The group, which is backed by senior figures and researchers from Anthropic, DeepMind, Hugging Face, and OpenAI, developed an attack method called Red-teaming via Iterative Strategy Evolution, or RISE.

The method uses one AI model to generate attempts to bypass safeguards and another to judge whether the output contains prohibited content. White Circle says the approach can identify attack strategies that work across different image generators.

The group also tested newer models, including OpenAI’s ChatGPT Images 2.5 and Google’s Nano Banana 2.1. White Circle told Ars Technica that both were “significantly more breakable than their previous versions.”

That finding remains a claim by the researchers, rather than an independently established comparison. White Circle’s founder, Denis Shilov, suggested two possible explanations: newer models may be capable of generating a wider range of content, or their developers may have prioritised capability over safety. Neither OpenAI nor Google responded to Ars Technica’s requests for comment on the findings.

Why Bypassing Image Safeguards Matters

The findings add to existing concerns about attempts to generate sexualized or explicit imagery using AI tools. In June, security firm Mindgard reported that relatively small prompt changes could trigger sexualized and graphic imagery in ChatGPT. The firm said OpenAI had introduced mitigations, but that it was still able to reproduce the issue during subsequent testing.

The broader concern is that safeguards may fail when models face attempts to circumvent their restrictions, even if they refuse direct requests for prohibited content. White Circle’s results suggest that freely available tools may be enough to test those weaknesses without access to specialized systems.

The consequences extend beyond violations of a platform’s content rules. Non-consensual AI-generated intimate images can harm people whose likenesses are used without permission, while AI-generated child sexual abuse material presents a separate and serious criminal concern.

The Internet Watch Foundation reported on Oct. 5 that its analysts had assessed 6,310 AI-generated images meeting the legal definition of child sexual abuse during the first half of 2026, exceeding the total recorded for all of 2025. Those figures concern child sexual abuse imagery and should not be conflated with White Circle’s tests of prohibited explicit content.

White Circle Plans to Release Its Testing Tools

White Circle plans to release its attack pipeline publicly and present its findings at NeurIPS in November. The group says wider access to the tools could help researchers reproduce the tests and allow developers to identify weaknesses in their safeguards.

But publishing the method could also make it easier for malicious users to attempt similar bypasses. That creates a trade-off between enabling independent scrutiny and limiting the spread of techniques that can be misused.

A Google co-authored study on non-consensual AI-generated intimate imagery argued that developers should strengthen protections at the point of image generation, alongside measures to limit the distribution of harmful content.

Shilov has also called for independent, third-party safety evaluations, arguing that AI companies should not be the only parties assessing their own safeguards.

White Circle’s findings provide a reason to examine image-generation filters more closely, but they do not establish how often ordinary users can bypass protections or prove that newer models are inherently less safe. Independent testing will be important in determining how broadly the results apply and whether companies need to strengthen their safeguards.