GPT-6 Astra and Gemini 4 Argon Face a Simple Jailbreak Test

A repeatable attack, not a one-off trick

The findings come from White Circle, whose preprint study describes the RISE attack method for bypassing safeguards on image-generation systems. RISE uses widely available models and an iterative process that evolves attack strategies over repeated attempts. The method was tested against leading systems from both OpenAI and Google, according to the paper.

That detail matters commercially. The issue is not simply whether a user can persuade a chatbot to produce one prohibited answer. Image generation is increasingly connected to multimodal assistants, computer-use systems and agentic workflows. A weakness in the image-safety layer could therefore create risk beyond a single conversation, particularly when models can call tools, process visual inputs or operate inside enterprise software.

Ars Technica reported on White Circle’s findings and quoted White Circle CEO Denis Shilov describing the results as “horrifying.” Shilov also argued that independent testing should be mandatory. His position is significant because it shifts the discussion from whether companies conduct internal evaluations to whether those evaluations are sufficiently adversarial and independent to reflect real-world use.

Safety claims meet adversarial testing

OpenAI’s own safety overview for GPT-6 Astra says the model underwent internal and external jailbreak testing. The company presents Astra as safer than GPT-5.6 Sol, framing progress in terms of improved resistance to attempts designed to defeat its safeguards.

Google makes a similar case for Gemini 4 Argon. In its responsible development and safety overview, Google describes layered protections against jailbreaks, including attacks that disguise harmful requests or divide them into many smaller questions. The company says its testing covers methods intended to bypass safety controls through indirect or incremental prompting.

The White Circle results do not necessarily disprove those internal claims. They do show why benchmark comparisons and scripted demonstrations are incomplete measures of deployment risk. A model may perform better than its predecessor in a company’s evaluation framework and still fail when an attacker uses an adaptive strategy that was not represented in that framework.

That distinction has direct business consequences. Safety is part of the product proposition for developers and enterprise customers, not merely a public-relations feature. If customers cannot predict how a system will behave under adversarial pressure, they may limit its permissions, avoid image-generation features or demand additional controls. Those precautions can reduce the value of the very agentic capabilities that companies are using to differentiate their platforms.

Competition shifts from capability to trust

OpenAI and Google are competing on more than model intelligence. Both are expanding systems that combine text, images, tools and autonomous actions. In that market, the stronger commercial moat may belong to the provider that can demonstrate reliable control across the entire product stack.

The RISE study therefore creates a difficult comparison. OpenAI’s Astra safety materials emphasize external testing and improvement over an earlier model. Google’s Argon materials emphasize layered defenses and coverage of disguised or fragmented attacks. White Circle’s research tests those assurances against an adaptive technique that uses accessible tooling rather than requiring a highly specialized attacker.

The available material presents criticism of the companies’ safeguards, including Shilov’s call for mandatory independent testing. It does not include a response from OpenAI or Google addressing the specific findings. That absence should not be treated as proof that either company accepts the researchers’ conclusions, but it does leave the central question unresolved: how do claimed safety improvements perform when the attacker, rather than the evaluator, controls the testing strategy?

For customers, the answer may matter as much as benchmark scores. Stronger models create more economic value only when businesses can trust their boundaries. Until independent, repeatable testing becomes a standard part of launch readiness, claims of safer AI will remain easier to demonstrate in controlled settings than to validate in the open market.