// ARS TECHNICA — INTELLIGENZA ARTIFICIALE
OpenAI, Google pushing new AI models easily tricked into making nudes, researchers say
Attack method exposes flaws in OpenAI, Google safeguards against AI nudes.
Safety researchers continue to warn that a large volume of AI-generated explicit content is spreading unchecked, while regulators do little to meaningfully stop it.
This non-consensual content is commonly shared in text and direct messages or stored in private clouds where it’s less likely to be detected or reported, a Google co-authored study of Internet users across the United States, Australia, and the United Kingdom found this July. That’s why the “most critical intervention point” remains at the source: the harmful AI tools used to make the fake sexual images, Google researchers concluded.
Yet red-teaming in recent months suggests that as some of the leading AI image generators from Google and OpenAI become more capable, they may be getting worse at blocking explicit outputs.
Raising the red flag are researchers at White Circle, a public benefit corporation backed by senior leaders and researchers from Anthropic, DeepMind, Hugging Face, and OpenAI. It was founded after CEO Denis Shilov posted one of the most famous universal jailbreaks of leading models in October 2024. Bent on breaking models to conduct thorough safety testing, White Circle helps companies detect and deter threats when implementing advanced AI systems that may not always behave as expected.
Testing how well text-to-image models block banned content categories is a key research direction for White Circle, and Shilov thinks their latest findings are “horrifying” enough to share with the public.
In a little-noticed preprint published last month, White Circle researchers exposed flaws in the guardrails of DALL·E 3, Google’s Nano Banana 2, and GPT-Image-2. In a press release, they explained that “using just off-the-shelf tools, available online for anyone to download, and by sending API calls, White Circle was able to use the novel attack method to bypass the safety filters” and generate explicit content about 13 percent of the time.
“Critically, none of these requests required custom-built or frontier AI models,” White Circle warned, so no AI expertise is needed to execute the attacks.
Researchers reviewed the outputs to verify the bypass rate, which White Circle noted is “the highest of any method tested under the same standard.” The key takeaway, they suggested, is that, “at a time when AI safety has never been under more scrutiny, the defenses leading labs have built are far weaker than they acknowledge.”
By publishing research like this, White Circle is positioning itself as an external evaluator of frontier labs, and it plans to open-source the entire attack pipeline so model makers can understand the true scale of the vulnerability and build stronger protections. Although the company has not widely promoted the research yet, it will share it at a prominent AI conference this November, NeurIPS 2026, which may increase scrutiny on Google and OpenAI later this fall.