研究人员称，OpenAI 和 Google 推出的新 AI 模型易被诱导生成裸露图像

“至关重要的是，这些请求中没有任何一个需要定制构建或前沿 AI 模型，”White Circle 警告称，因此执行这类攻击不需要具备 AI 专业知识。

研究人员审查了输出结果，以验证绕过率。White Circle 指出，这一绕过率“是在相同标准下测试的所有方法中最高的”。他们认为，关键结论是：“在 AI 安全从未受到如此严格审视的当下，领先实验室建立的防御体系远比它们承认的更为脆弱。”

通过发布此类研究，White Circle 正将自身定位为前沿实验室的外部评估者；该机构计划将整个攻击流程开源，以便模型制造商了解这一漏洞的真实规模，并构建更强的保护措施。尽管该公司尚未广泛宣传这项研究，但计划在今年 11 月举行的重要 AI 会议 NeurIPS 2026 上分享成果，这可能在今年秋末加大外界对 Google 和 OpenAI 的审视。

Shilov 告诉 Ars，White Circle 已通过“共同联系人”向一些前沿 AI 实验室分享了研究发现；但 Google 和 OpenAI 均未回应 Ars 就其模型中发现的漏洞所提出的直接置评请求。

与此同时，OpenAI 和 Google 分别发布了新模型——ChatGPT Images 2.5 和 Nano Banana 2.1。White Circle 告诉 Ars，使用相同方法进行的提示词安全测试显示，“两者都比前代版本更容易被攻破”。

在 Ars 分享这些新发现后，两家公司均未作出回应。

Shilov 告诉 Ars，White Circle 的攻击方法能够瓦解前沿模型在显式内容等看似容易识别类别上的防御。这也预示着，目前正被更新以阻止其他不受欢迎 AI 行为——例如黑客攻击——的更严肃防御系统，前景并不乐观。

“White Circle 对此的工作假设是：要么新模型更复杂、能力更强，能够生成更广泛类型的内容；要么是安全性已被为了能力而降低优先级，”White Circle 告诉 Ars。

“Critically, none of these requests required custom-built or frontier AI models,” White Circle warned, so no AI expertise is needed to execute the attacks.

Researchers reviewed the outputs to verify the bypass rate, which White Circle noted is “the highest of any method tested under the same standard.” The key takeaway, they suggested, is that, “at a time when AI safety has never been under more scrutiny, the defenses leading labs have built are far weaker than they acknowledge.”

By publishing research like this, White Circle is positioning itself as an external evaluator of frontier labs, and it plans to open-source the entire attack pipeline so model makers can understand the true scale of the vulnerability and build stronger protections. Although the company has not widely promoted the research yet, it will share it at a prominent AI conference this November, NeurIPS 2026, which may increase scrutiny on Google and OpenAI later this fall.

White Circle has shared its findings with some frontier AI labs through “mutual contacts,” Shilov told Ars, but neither Google nor OpenAI responded to Ars’ request to comment directly on vulnerabilities found in their models.

Meanwhile, OpenAI and Google have released new models—ChatGPT Images 2.5 and Nano Banana 2.1—and White Circle told Ars that prompt safety testing using the same method showed “both are significantly more breakable than their previous versions.”

Neither company responded after Ars shared these new findings.

White Circle’s attack method can break down frontier defenses in categories, like explicit content, that seem easy to spot, which doesn’t bode well for more serious defense systems currently being updated to block other unwanted AI behavior, like hacking, Shilov told Ars.

“White Circle’s working hypothesis for this is either the newer models are more sophisticated and capable of generating a wider range of content, or that safety has been deprioritized in favor of capability,” White Circle told Ars.