On 14 October 2026, White Circle told Ars Technica that ChatGPT Images 2.5 and Google’s Nano Banana 2.1 are “significantly more breakable” than the versions they replace. The labs did not answer. The temptation is to paste last month’s attack-success rate onto that sentence. That would be the wrong story.
White Circle put OpenAI and Google's newest image stacks on notice
White Circle is a public-benefit safety firm whose roster draws from people with Anthropic, DeepMind, Hugging Face and OpenAI ties. Its chief executive, Denis Shilov, built a public reputation in October 2024 by demonstrating a widely shared jailbreak against major chat models, then turned that posture into a company that red-teams production systems and sells runtime controls.
The 14 October peg is blunt. After OpenAI and Google shipped ChatGPT Images 2.5 and Nano Banana 2.1, White Circle told Ars that the same red-team method used in its recent work found both systems “significantly more breakable than their previous versions.” Ars reported that neither company responded after those newer findings were shared for comment. White Circle’s working hypothesis, offered to Ars, is either that the newer models are simply more capable across a wider range of content, or that safety has been deprioritised relative to capability. A hypothesis is not a measured rate.
The 13 percent figure stops at last month's three models
The quantitative record sits in a September preprint, not in the October quote. On 28 September 2026, White Circle researchers Dmitrii Kharlapenko, Sergei Bratchikov, Konstantin Korolev and Aleksandr Nikolich posted RISE: Red-teaming via Iterative Strategy Evolution for Modern Text-to-Image Models to arXiv as 2609.34920. The abstract’s headline result is up to 13 percent human-verified attack success on three production systems available to the authors at the time: DALL·E 3, Google’s Nano Banana 2, and OpenAI’s GPT-Image-2.
That scope matters. The 13 percent figure is an upper bound for those three systems under the authors’ calibrated evaluation. It is not a published rate for ChatGPT Images 2.5 or Nano Banana 2.1. Clarifying coverage that followed Ars made the same separation explicit: the newer-model claim is qualitative and separate from the preprint’s numerical result. Ars’s corrected reporting further breaks the older set down by model, with the highest human-verified rate on DALL·E 3 and lower rates on Nano Banana 2 and GPT-Image-2. None of those percentages travel forward to the October models unless White Circle or the labs publish a matched table.
Methodologically, RISE is aimed at a hardened commercial regime where one-off prompt rewriting often fails. The authors argue that many earlier papers reporting roughly 30 percent success collapse toward zero once outputs are rescored with judges calibrated against human labels and with category-specific success criteria. At a high level, RISE evolves reusable natural-language attack strategies, then uses those strategies to generate diverse prompts, rather than editing a single seed forever. The public write-up describes an attacker built from a widely available Qwen3-32B checkpoint with safety training removed, and a Gemini 2.5 Flash judge tuned against human annotation. Midjourney was excluded because it lacked a public API suitable for controlled benchmarking. Frontier’s brief stops there: the preprint’s ethics section withholds discovered strategies, final attack prompts and unsafe images, and this article does not reconstruct them.
OpenAI's Images 2.5 card grades its own stack; Google stayed quiet
OpenAI’s public answer to capability risk, published 8 September 2026 on its Deployment Safety Hub, is a system card for ChatGPT Images 2.5. The card describes a multi-layer stack: upstream refusals before generation, input and output blocking by a safety reasoning monitor, and continued provenance work including C2PA and SynthID. On OpenAI’s own automated adversarial evaluation, GPT-Image-2.5-Sunburst shows about 1.09 percent unsafe generations presented overall, with the sexual-content row at 0.52 percent unsafe presented; Flare sits a little higher. Against the ChatGPT Images 2.0 baseline, several categories improve and the card flags that residual unsafe-shown differences are not always statistically significant.
Those tables are real evidence of what OpenAI measured on a fixed internal set. They are not a published reply to White Circle’s October claim about Images 2.5 under RISE. Google, for its part, has marketed Nano Banana 2.1 as a capability upgrade in the Gemini image line and has separately co-authored research arguing that the most critical intervention point for non-consensual intimate imagery sits at the generation tools themselves. That pathway framing explains why consumer guardrails matter even when dedicated abuse apps exist. It does not substitute for a matched response to White Circle’s newer-model breakability claim. Ars also relayed Internet Watch Foundation figures showing a sharp rise in AI-generated child sexual abuse material meeting legal definitions in the first half of 2026. Those counts establish harm pressure on the category. They do not validate any particular jailbreak recipe, and this piece does not describe one.
Independent ASR and vendor cards are not the same exam
A careful reader needs two separate ledgers. One ledger is an independent, human-verified attack-success rate under a disclosed protocol, with judges calibrated against human labels. That is what RISE claims to offer for the September model set. The other ledger is a lab’s internal safety card: adversarial prompts the vendor designed, outcomes the vendor classified, and mitigations the vendor controls. Both can be informative. Neither automatically falsifies the other.
White Circle is pushing the political implication hard. Shilov told Ars that labs should invest more in safety and security around their models, that self-assessment is insufficient, and that governments should push independent third-party evaluation. The company plans to present at NeurIPS 2026 and to release a reproduction pipeline for defenders and policymakers while withholding the highest-misuse artifacts. Whether mandatory audits arrive is a separate fight. The narrow editorial rule for Monday is simpler: do not treat a vendor card’s low unsafe-presented percentage as a rebuttal of an outside qualitative claim until someone publishes a matched comparison.
A qualitative “more breakable” line is not a published rate
Several things remain unproven in the public record. White Circle has not, in the sources checked for this piece, released a human-verified ASR for ChatGPT Images 2.5 or Nano Banana 2.1. “Significantly more breakable” is an attributed comparison, not a percentage. The capability-versus-deprioritisation hypothesis is offered as interpretation. OpenAI’s September card does not mention RISE, and Google has not published a parallel table answering the October quote. Silence is not confession; it is also not a defence.
Equally, the September 13 percent figure should not be inflated into a claim that every consumer image request succeeds, or that every prior red-team paper was fabricated. The authors’ sharper point is measurement: weak judges and seed-tied methods can produce impressive numbers that fail under stricter scoring. That is an argument about evaluation quality. It still leaves the newest models waiting for published rates.
Until the labs publish matched numbers, treat the newest claim as open
What would settle the 14 October peg is boring and specific. White Circle could publish human-verified rates for Images 2.5 and Nano Banana 2.1 under the same protocol used in arXiv 2609.34920. OpenAI and Google could publish matched external-eval responses, including where they disagree with White Circle’s criteria. Policymakers asking for third-party audits would still need to decide what must be public versus what stays under NDA. Until one of those documents lands, the responsible posture is to hold the qualitative claim as open, keep the 13 percent figure attached to last month’s three models, and refuse headlines that merge the two.
The capability race will keep shipping prettier images. The safety argument only gets sharper when outside evaluators can put a dated number next to a dated release, and when the labs answer in kind.