Red-teaming finds ChatGPT Images 2.5 easier to bypass than its predecessor
White Circle built an attack pipeline from open models and measured roughly a 3% bypass rate on GPT-Image-2, while the newer Images 2.5 proved notably more vulnerable.
The disturbing part is not that AI generates explicit images. It is that frontier defenses are actively getting weaker as models advance. Recent red-teaming from White Circle tested commercial text-to-image safeguards using an automated pipeline dubbed RISE. Instead of custom frontier tech, the entire attack engine was assembled from off-the-shelf components: an unaligned Qwen3-32B model downloaded from Hugging Face as the attacker, paired with Gemini 2.5 Flash acting as the judge. Sending standard API calls through this loop produced human-verified bypass rates of roughly 13% on DALL-E 3, under 10% on Google Nano Banana 2, and about 3% on GPT-Image-2. None of these were total failures, but they proved repeatable across prompts. When researchers subsequently tested the latest releases, ChatGPT Images 2.5 and Nano Banana 2.1, both proved significantly more breakable than the versions they replaced. Neither OpenAI nor Google responded to requests for comment. If you want to know whether a lab's security posture is actually advancing, stop reading self-published safety sheets. Demand independent, cross-generational regression benchmarks before accepting that a newer model is safer just because it is more capable.