AI Image Filters Fail One In Eight Times, And The Newest Models Are Worse
A security research firm says it broke through the explicit-content filters on three of the industry's most closely watched image generators, using nothing more exotic than carefully built prompt strategies.
White Circle ran a jailbreak method it calls RISE, short for Red-teaming via Iterative Strategy Evolution, against OpenAI's DALL-E 3 and GPT-Image-2, along with Google's Nano Banana 2. According to findings reported by Ars Technica on October 14, the technique got past filters designed specifically to block explicit content about 13% of the time. White Circle says the approach didn't require a custom frontier model or specialized AI expertise, just prompt strategies built to generalize across different systems rather than rely on one-off tricks.
That 13% figure is the headline number, and it's the one most coverage will lead with. It's a real number worth sitting with: a filter built by a well-resourced safety team failed about once in every eight attempts against a method that didn't need insider access to pull off.
The part most coverage will miss
The more uncomfortable detail in White Circle's findings isn't the 13% baseline. It's what happened when the firm pointed RISE at the newer generation of tools. ChatGPT Images 2.5 and Nano Banana 2.1, the models meant to replace DALL-E 3, GPT-Image-2 and the original Nano Banana 2, turned out to be significantly more vulnerable than the versions they succeeded. Safety filtering did not improve with the newer releases. It got worse.
White Circle plans to open-source its RISE testing pipeline and present the work at NeurIPS 2026, one of the AI field's largest research conferences. Once that pipeline is public, both the labs trying to patch against it and anyone trying to exploit it will have access to the same playbook at the same time.
The findings also land next to a separate, grim data point cited in the same reporting: the Internet Watch Foundation identified 6,310 AI-generated images meeting the legal definition of child sexual abuse material in the first half of 2026 alone, about 40% more than the foundation recorded across the entirety of 2025. White Circle's research doesn't draw a direct line between its jailbreak and that figure, but the two sit in the same reporting as evidence of what filter failure costs in the real world.
Analysis (opinion)
This site's analyst on AI safety and product risk has made a habit of looking past the number everyone quotes to the trend line underneath it, and that's exactly where this story gets interesting. The industry narrative, repeated by both OpenAI and Google for years, is that each new release tightens the guardrails as the underlying model gets more capable. White Circle's results say the opposite happened here. As these systems get better at following complex, layered instructions and rendering realistic detail, they also appear to get better at following the layered, indirect instructions a jailbreak uses to route around a content filter. Capability and controllability are not the same skill, and a newer model being easier to break is a direct demonstration of that gap, not a one-off bug.
For founders building products on top of these APIs, the analyst's read is that this is not an abstract compliance footnote. Nonconsensual intimate imagery sits at the center of a fast-moving legal fight, with multiple states passing deepfake-specific civil and criminal statutes in the past two years. Any platform built on an API that can be jailbroken into producing that content inherits exposure, regardless of which lab built the underlying model. A 13% bypass rate on an explicit-content filter isn't a rounding error for investors evaluating these companies. It's a liability line item.
To be fair to OpenAI and Google, this is not the same story as Elon Musk's xAI, whose Grok Imagine tool drew state attorneys general inquiries and condemnation from the European Commission in early 2026 after reports that Musk pushed teams to loosen safety guardrails before launch. OpenAI and Google did not loosen anything on purpose. Their filters were built to stop exactly this kind of output, and a researcher working alone got through them anyway in roughly one try out of eight. That's arguably a harder problem for the industry to explain away, because it isn't a story about a company choosing to cut corners. It's a story about two of the best-funded safety teams in AI shipping guardrails that don't hold.
The question worth asking now isn't whether OpenAI and Google will patch against this specific jailbreak before NeurIPS 2026. It's whether any lab can keep proving that more capable models are also more controllable ones, or whether every future release is quietly making that promise harder to keep.
Just as seo relevant keywords backlinks help search engines understand a page’s focus, clear and accurate image labeling helps AI filters decide what content truly belongs online.
Source: Startup Fortune
If you missed it: YouTube Music Will Tell You When a Song Isn't Human. It Won't Tell You What Happens Next.
