October 14, 2026
Off-the-shelf tools get past OpenAI and Google image filters 13% of the time
White Circle got prohibited images in 13% of attempts, and by its measurement the newest model versions break even more easily.
A prohibited explicit image came out roughly once every eight attempts.
White Circle ran DALL·E 3, Nano Banana 2 and GPT-Image-2 through downloadable tools and plain API calls, with no models of its own and no AI specialists. The safeguards failed in 13% of attempts. The authors call this the highest bypass success rate among methods tested against a single standard (Ars Technica, Oct 14, 2026).
One method worked against the two largest image generation providers at once.
The fresh release breaks more easily. ChatGPT Images 2.5 came out on Sep 8, 2026, and Nano Banana 2.1 appeared on Oct 6, 2026. White Circle tested both and calls them noticeably more fragile than the previous versions.
Google DeepMind's model card for Nano Banana 2.1 promises red-team testing, passed child safety thresholds and safety at the level of Gemini 3 Flash or higher. The outside measurement says otherwise.
A move is coming anyway. Nano Banana 2.1 costs half as much: $0.0336 per 1K image instead of $0.0670. Google is shutting down the previous gemini-3.1-flash-image on Oct 29, 2026.
The series goes back to last year. In December 2025, Italy's Icaro Lab pulled prohibited content out of more than 62% of tested chatbots with "adversarial poetry". In June 2026, the UK's Mindgard showed that a slightly altered popular prompt squeezes sexualized and violent images out of GPT-5.4 without a direct request, after which OpenAI tightened its safeguards.
A preprint describing the method came out in September 2026; White Circle founder Denis Shilov called the results horrifying and disclosed them publicly. Neither OpenAI nor Google responded to Ars Technica's requests.
White Circle promises to open-source the method and present its findings at NeurIPS 2026 in November.