OpenAI, Google pushing new AI models easily tricked into making nudes, researchers say
Researchers at White Circle say an attack using readily available online tools can bypass safeguards in several OpenAI and Google image models, producing explicit images in about 13 per cent of attempts. The findings raise concerns that increasingly capable image generators may be less reliable at blocking non-consensual sexual content, which is often shared privately and difficult to detect.
White Circle tested DALL·E 3, Google’s Nano Banana 2 and GPT-Image-2, and says newer releases ChatGPT Images 2.5 and Nano Banana 2.1 were significantly easier to break using the same method. Researchers reviewed the outputs and described the success rate as the highest among methods tested to the same standard. White Circle plans to open-source its attack pipeline and present the work at NeurIPS 2026 in November; Google and OpenAI did not respond to requests for comment.
- White Circle says its attack produced explicit content in about 13 per cent of attempts.
- Newer OpenAI and Google image models were reportedly easier to bypass.
- Researchers plan to publish the attack pipeline and present their findings in November.
New here? Start with this
AI image generators create pictures from text prompts, while safety filters are meant to stop them producing certain material, including sexual images. OpenAI and Google are among the companies developing these tools, which are used to make and edit images.
Non-consensual sexual images can harm the people depicted, and may be shared privately in ways that make them hard to find or remove. How reliably image generators block such material matters as the systems become more widely used and more capable.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The findings warrant concern because image models can be used to create sexual images without someone’s consent, and such material may be shared privately and be hard to detect or remove. If the reported attack works with readily available tools, companies should strengthen safeguards and give users clear ways to report failures as their models become more capable.
The case against
The reported success rate is about 13 per cent, so the tests also suggest the safeguards blocked most attempts; the excerpt gives no detail on the test conditions or how well the results generalise to real-world use. Publishing the attack method could help developers assess and fix weaknesses, while the findings alone do not establish how often people will misuse the models or whether the newest systems are less safe overall.