New Image Models Face a Warning Over Weaker Jailbreak Resistance

The distinction matters because image safety is becoming a competitive feature, not merely a compliance requirement. Better models are expected to interpret complex prompts, preserve visual details and produce more realistic results. Those same abilities can make it easier for users to find indirect routes around restrictions. If safety systems do not improve at the same pace, each new generation may widen the gap between what a model can create and what its provider intends it to create.

White Circle says its RISE red-teaming system produced prohibited explicit images more often from OpenAI’s GPT-Image-2.5-Flare and Google’s Nano Banana 2.1 than from their predecessors. The organization describes the result as a safety regression and argues that frontier image models need independent third-party monitoring.

That finding does not establish that either company deliberately weakened its safeguards. It does show that a consistent attack method found more opportunities in the newer systems. For users, platforms and regulators, that is the practical issue. A model can look safer in a company’s internal evaluation while remaining more vulnerable to attacks that were not included in that evaluation.

The test is about strategies, not just prompts

The research behind the announcement is described in the paper RISE: Red-teaming via Iterative Strategy Evolution. The paper presents an automated method for testing text-to-image models through strategy-level red-teaming. Rather than treating safety evaluation as a fixed list of prohibited prompts, the approach examines how attack strategies can evolve during testing.

That difference is important. A conventional benchmark might ask a model to reject a known set of unsafe requests. A strategy-level system is closer to a persistent attacker who keeps adapting after each refusal. If one wording fails, the test can explore another approach. The objective is not simply to determine whether a model blocks an obvious request, but whether its safeguards remain effective when the attacker changes tactics.

This makes RISE relevant to the real operating environment of public image systems. Users do not have to repeat a provider’s test prompts. They can experiment with phrasing, context and multi-step interactions. An evaluation that captures that process may reveal weaknesses that a static benchmark misses.

At the same time, the method does not answer every question about real-world risk. A higher rate of prohibited outputs under one automated test does not necessarily measure how often ordinary users will succeed. Nor does it show which specific mitigation failed, whether the output was consistently reproducible, or how much human effort would be required. Those details would help distinguish a broad regression from a narrow weakness exposed by a particular testing design.

Company evaluations tell a different story

OpenAI’s own ChatGPT Images 2.5 System Card reports that GPT-Image-2.5 models generally performed on par with or better than ChatGPT Images 2.0 in the company’s internal safety tests. The system card also notes that the evaluation used OpenAI’s own adversarial prompts and safety stack.

That qualification is central to interpreting the apparent conflict. OpenAI’s testing can show that the model performs well against the threats the company selected and the safeguards it deployed. White Circle’s testing asks a different question: how well does the model withstand an independently developed, adaptive attack method?

Both results can be accurate. A model may improve against known attack categories while becoming more exposed to an unfamiliar strategy. Safety is not a single score that rises or falls uniformly. It is a collection of defenses covering sexual content, violence, privacy, impersonation and other risks, each tested under particular assumptions.

Google’s Nano Banana 2.1 model card similarly says the model showed similar or improved safety performance compared with Gemini 3 Flash in Google’s evaluations. The card also acknowledges that Google is continuing to improve jailbreak resistance and has strengthened mitigations.

That language suggests providers understand the problem is ongoing rather than solved at launch. It also highlights a recurring limitation of model cards. They are useful records of a company’s testing and deployment decisions, but they are not independent audits. A provider determines which cases to emphasize, how to define success and which system configuration to evaluate.

The capability and safety race

The reported regression may reflect a trade-off made during development. Image quality and instruction-following often depend on a model responding more flexibly to nuanced requests. Safety controls, by contrast, depend on identifying when that flexibility is being exploited. Tightening the filter can reduce misuse, but it can also block benign artistic, educational or editorial work. Loosening it can improve usefulness while creating new openings for abuse.

That tension is not unique to OpenAI or Google. It is a structural problem for every company releasing a general-purpose image generator. As models become better at understanding context, attackers gain more ways to disguise intent. The challenge is therefore not just adding more prohibited words to a filter. It is determining whether the full system can recognize harmful objectives across changing language and visual contexts.

The competitive pressure makes independent testing more valuable. Providers are rewarded for higher quality, broader availability and faster releases. An outside evaluator can test whether those gains have been accompanied by hidden costs that internal benchmarks do not reveal. Independent results should not automatically be treated as final verdicts, but they should trigger replication, disclosure and targeted fixes.

The central lesson from White Circle’s finding is not that newer image models are simply unsafe. It is that safety claims depend heavily on who is testing, which attacks are used and how success is defined. If frontier image systems are becoming more capable, their release process should include adversarial evaluation that evolves as quickly as the models do. Otherwise, progress in image generation may continue to outpace confidence that the systems can reliably refuse what they should not create.