White Circle: ChatGPT Images 2.5 and Nano Banana 2.1 Are Easier to Jailbreak Than Previous Versions

What the Report Found

White Circle, an organization specializing in AI safety, said in a report published on October 14, 2026 that it had evaluated OpenAI's ChatGPT Images 2.5 and Google's Nano Banana 2.1: bypassing the safety filters meant to block explicit content has become "noticeably easier" in both models than in previous versions. The report was published via Ars Technica. The findings concern exactly the newest versions: ChatGPT Images 2.5 is OpenAI's latest image generation model, and Nano Banana 2.1 is Google's.

Safety filters are the protective layer of a model designed to refuse requests for prohibited content. According to White Circle's conclusion, this layer is being bypassed more easily in the new generation of models than before. The report notes that this behavior was observed in both companies' latest image models.

It is worth noting that the RISE method was tested in the research paper on DALL-E 3, GPT-Image-2, and Nano Banana 2. Relying on these results, White Circle concluded that the newest versions are easier to break than the previous ones.

The primary source of the research is a preprint openly published on arXiv (arXiv identifier: 2609.34920); the October 14 report publishes the latest results obtained as part of this research.

RISE: An Automated Testing Method

White Circle's conclusions rest on a method called RISE (Red-teaming via Iterative Strategy Evolution). A red-team test evaluates a system from the attackers' perspective rather than the defenders'; in RISE, attack strategies are automatically improved based on the outcome of each attempt — the system remembers which approach bypassed the defense and builds the next attempt accordingly.

The full description of the method was published in an open scientific preprint on arXiv on September 28, 2026. It shows RISE was tested on three models: OpenAI's DALL-E 3 and GPT-Image-2 and Google's Nano Banana 2. According to results confirmed by human experts, the success rate of attacks aimed at bypassing safety systems and obtaining prohibited explicit content reached 13% — nearly one in seven attempts succeeded. "Human-confirmed" means this was not an automated assessment: experts manually reviewed each successful case. 13% is the highest rate recorded during the tests.

In practice, the iterative approach works like this: the system first probes the defense with a simple request, analyzes the model's response, then changes strategy in the next attempt. Each successful bypass serves as a template for subsequent attacks — so the generation of attack strategies keeps improving.

Notably, these attacks did not require specially developed advanced tools or deep technical expertise. According to White Circle, the tests were conducted using off-the-shelf software tools and simple API calls — neither specially built advanced models nor deep expertise were needed to carry them out.

The chronology is also notable: the scientific description of the method was openly published on arXiv on September 28, 2026, and almost two weeks later the organization released a separate report on the newest models. In other words, the method itself was first presented to the research community, and then the latest results obtained with its help were published.

Possible Causes and Company Responses

"ChatGPT Images 2.5 and Nano Banana 2.1 are noticeably easier to jailbreak than previous versions," the White Circle report states.

The organization's founder, Denis Shilov, named two possible reasons for the observed phenomenon — these are not confirmed conclusions yet, but candidate explanations. First, the new models may be capable of generating a wider range of content than their predecessors. Second, developers may have prioritized new capabilities over safety measures. Both explanations remain speculative for now.

Neither OpenAI nor Google responded to a request for comment — the official positions of both companies remain unknown.

Next Steps

White Circle plans to open-source the RISE testing pipeline — then independent researchers will be able to use the method and independently verify the results. Once the pipeline is published, other safety teams will also be able to test their own image models with the same automated method. The full text of the research is openly published on arXiv — since the preprint is open, all details of RISE are available for independent study. The results are planned to be presented at the NeurIPS 2026 scientific conference.