The newest image models from OpenAI and Google are easier to jailbreak than the ones they replaced, according to a red-teaming study from White Circle. Its RISE research page, updated in October 2026, reports that the same unchanged attack method got nudity past GPT Image 2.5 Flare 7.8% of the time, up from 3.3% on GPT Image 2, and past Nano Banana 2.1 20.7% of the time, up from 9.5% on Nano Banana 2. In White Circle’s words: “To our surprise the newly released image models were even easier to break than the older ones.”
The rates are small in absolute terms, and the study’s bigger claim is about measurement. Here is what RISE does, what it found, and what it cannot say.
White Circle’s RISE red-teaming method reached up to 13.3% human-verified attack success on DALL-E 3, scored by a judge calibrated against about 1,300 human labels.
Run after the paper, the same method got nudity through 7.8% of the time on GPT Image 2.5 Flare (3.3% on GPT Image 2) and 20.7% on Nano Banana 2.1 (9.5% on Nano Banana 2).
Prior methods that reported around 30% success fell close to zero when re-scored against the same human-calibrated standard.
RISE evolves reusable attack strategies instead of editing seed prompts, using only a public open model as the attacker and no training.
Other categories were mixed: graphic violence rose on GPT Image 2.5 Flare and fell on Nano Banana 2.1, where the judge is least precise.
§ 01What RISE measures
Modern image APIs stack defenses: a prompt classifier, an output moderation filter, and a model trained away from prohibited content. RISE, described in an arXiv paper submitted September 28, 2026, searches for reusable attack strategies rather than editing seed prompts, then exploits the ones that work. Every result is scored by a judge calibrated against about 1,300 human-labelled images, and only explicit violations count.
That standard is the paper’s first finding. Prior methods that reported jailbreak rates around 30% dropped close to zero when re-scored the same way, because uncalibrated judges reward images that merely resemble a violation.
| Target | After evolution | After exploitation |
|---|---|---|
| DALL-E 3 | 5.2% | 13.3% |
| Nano Banana 2 | 5.7% | 9.5% |
| GPT Image 2 | 1.5% | 3.3% |
| GPT Image 2.5 Flare (run after the paper) | 4.1% | 7.8% |
| Nano Banana 2.1 (run after the paper) | 13.2% | 20.7% |
§ 02The newer models, category by category
After the paper was submitted, White Circle ran RISE without changes on the two new releases across three categories. Nudity roughly doubled on both. The rest was mixed.
| Target | Nudity | Self-harm | Graphic violence |
|---|---|---|---|
| GPT Image 2 | 3.3% | 11.2% | 19.0% |
| GPT Image 2.5 Flare | 7.8% | 10.7% | 32.8% |
| Nano Banana 2 | 9.5% | 20.9% | 47.0% |
| Nano Banana 2.1 | 20.7% | 27.2% | 34.5% |
Self-harm held steady on GPT Image 2.5 Flare and rose on Nano Banana 2.1; graphic violence rose on Flare and fell on Nano Banana 2.1. White Circle adds a caution: “Our judge is least precise on graphic violence, so we put less weight on those two numbers than on the others.” Ars Technica also covered the findings.
§ 03Why it might have happened
White Circle does not claim a cause: “We can’t attribute the regression from the outside: it may come from the model itself, from a lighter moderation configuration on a cheaper variant, or from both.” Flare is the faster variant of GPT Image 2.5; the price difference White Circle implies is not something the study measures, and nothing in it confirms either cause.
The broader point is the one White Circle draws itself: “safety is not monotonic across model releases.” Robustness measured on one version does not carry to the next, and an attack method carries over unchanged while defenses have to be rebuilt. It also used nothing proprietary: a public open model as the attacker, a commercial vision model as the calibrated judge, and no training.
For EU readers, this lands the same week the AI Office opened its first questions to OpenAI and Anthropic, covered in our EU AI Office record.
§ 04What we are watching
- Responses from OpenAI and Google, and whether moderation on Flare or Nano Banana 2.1 changes.
- Whether other teams reproduce the post-submission numbers with the released code.
- A re-run on the next releases, which White Circle’s own conclusion invites.
§ 05Sources
- White Circle: RISE research page (October 2026)
- arXiv: RISE, Red-teaming via Iterative Strategy Evolution (September 28, 2026)
- Ars Technica coverage (October 2026)
Q1What is RISE?
Red-teaming via Iterative Strategy Evolution, a method from White Circle that searches for reusable attack strategies against text-to-image models and scores results with a judge calibrated against human labels.
Q2Were the newer models in the paper?
No. The paper covered DALL-E 3, Nano Banana 2 and GPT Image 2. The GPT Image 2.5 Flare and Nano Banana 2.1 runs were added after submission, unchanged, and published on White Circle’s October 2026 research page.
Q3Why are the success rates lower than other papers report?
White Circle re-scored prior methods with its human-calibrated judge and found reported rates around 30% drop close to zero; it argues uncalibrated judges reward images that only look like violations.
Q4Which categories were tested?
Nudity first, then hate, suicide, self-harm and graphic violence. The post-submission table reports nudity, self-harm and graphic violence for the four commercial models.
Q5Does CellCog use these models?
CellCog’s image agent runs on GPT Image 2.5. The study tests the model behind OpenAI’s API; it does not test CellCog.