White Circle Says OpenAI’s and Google’s Latest Image Models Resist Jailbreaks Less Than Their Predecessors

White Circle says its RISE red-teaming method found newer versions of named OpenAI and Google image models more susceptible to policy-violating jailbreaks than their predecessors. Specifically, it reports higher susceptibility for GPT-Image-2.5-Flare than an earlier GPT-Image model, and for Nano Banana 2.1 than Nano Banana 2. The comparison comes from White Circle’s own evaluation.

That cuts against a common assumption that each new model version inherits or improves on its predecessor’s protections. But the evidence supports a narrower conclusion: under one purpose-built, iterative red-team test, White Circle’s methods got past the newer models more readily. Nothing in the available material explains why.

What RISE is. The name stands for Red-teaming via Iterative Strategy Evolution. According to the paper on arXiv, it develops strategies for eliciting policy-violating images from production text-to-image systems, then scores the results with judgments calibrated against human assessments. It’s an adversarial tool designed to find weaknesses, not a measure of ordinary use. A “success” means a strategy produced an output judged to violate policy under the study’s process. It doesn’t mean that share of everyday requests would produce unsafe images.

White Circle also reports a human-verified policy-violation success rate of up to 13% across DALL·E 3, Nano Banana 2, and GPT-Image-2. Don’t read that as a universal safety score. It covers a specific set of models under an adversarial method, and the material doesn’t present it as a typical outcome or a real-world misuse rate. Ars Technica reports that White Circle identified reusable strategies that got around safeguards in leading OpenAI and Google image products. Reusable matters because an iterative technique can adapt as defenses block earlier attempts. How well those strategies transfer across products, settings, languages, policy categories, or future updates isn’t established.

Why the “why” is unanswered. The tempting explanation is that newer models have weaker guardrails. The published material doesn’t separate that from other possibilities. Because RISE evolves its strategies as it goes, a model-to-model gap could reflect changes in the underlying model, changes in the moderation layer, differences in how each system reads requests, or simply how well White Circle’s strategies fit each target. There’s no ablation holding those factors apart, no comparison with OpenAI’s or Google’s internal safety testing, and no measure of how often real users hit the tested failure modes. The result also doesn’t show either company weakened protections on purpose.

Bottom line: Don’t take this as proof that image-model safety is getting worse, and don’t dismiss it as a contrived benchmark either. It’s evidence that a newer release can resist a known class of adaptive jailbreak testing less well than an earlier one. Whether the gap holds up under independent evaluation, and what causes it, are the questions that decide how much weight it deserves, and the public record can’t answer either yet.