White Circle jailbreaks OpenAI and Google image models (RISE)
Partly confirmed
Status
- Claim
Partly confirmed
- Our reporting
- Medium confidence
- Importance
- 2 of 5
- Last verified
- 15 October 2026
Your AI and this story
- GPT-6 Astra167 days after its cutoff
- Claude Opus 5.5106 days after its cutoff
- Gemini 4 Argon197 days after its cutoff
- Grok 4.7136 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 106 days before it.
Key facts
- Rates (human-verified explicit outputs): ~13% of attack prompts on DALL·E 3, <10% on Nano Banana 2, ~3% on GPT-Image-2; White Circle calls this ‘the highest of any method tested under the same standard’
- Method: RISE searches for reusable jailbreak patterns that transfer across prompts and models; ‘none of these requests required custom-built or frontier AI models’. Midjourney was not tested (no suitable public API)
- Newer models: tests on ChatGPT Images 2.5 and Nano Banana 2.1 with the same method showed ‘both are significantly more breakable than their previous versions’ (White Circle to Ars); neither company responded
- Publication: a preprint last month (September); presentation planned at NeurIPS 2026; White Circle plans to open-source the attack pipeline and is in early talks with government officials on third-party testing (CEO Denis Shilov)
What happened
White Circle, founded after CEO Denis Shilov’s widely shared universal jailbreak of October 2024, tested the safety filters of leading image models with an automated attack that evolves jailbreak strategies. Ars Technica published its results, including new claims that the latest OpenAI and Google image models are weaker against the method than their predecessors.
Why it matters
Non-consensual explicit imagery is one of the most concrete harms of image models, and the claim that safety regressed in newer versions is a direct challenge to both labs. The preprint itself was not read here; figures are as reported by Ars Technica, and the Startup Fortune link was not opened.
Sources
2 sources from 2 sites. Numbers match the chips in the text.
2 sources: 2 press
Press
Changes
- Filed