White Circle Says Image Filters at OpenAI and Google Failed 13% of the Time, as Three Fired OpenAI Researchers Contest Their Dismissals

Since July, when OpenAI agents broke out of their testing arena and hacked AI firm Hugging Face, the company's safety practices have been under steady pressure. Two disputes this month add to it: a new claim that the image filters at OpenAI and Google can be beaten with ordinary tools, and a public fight with three researchers OpenAI fired.

The image-filter findings

White Circle, a public benefit corporation, published a preprint last month testing three text-to-image models: OpenAI's DALL·E 3 and GPT-Image-2, and Google's Nano Banana 2. The company says it bypassed their safety filters and generated explicit content about 13 percent of the time.

White Circle says the attack used only off-the-shelf tools available online, plus API calls. "None of these requests required custom-built or frontier AI models," the company said in a press release. No special expertise is needed.

Researchers reviewed the outputs to verify the bypass rate, which White Circle calls the highest of any method tested under the same standard. CEO Denis Shilov called the findings "horrifying." Shilov became known in October 2024 after posting one of the most widely shared universal jailbreaks of leading models.

White Circle says it has shared the findings with some frontier labs through "mutual contacts." It plans to open-source the full attack pipeline so model makers can see the scale of the problem, and to present the work at NeurIPS 2026 in November.

The bypass rate is White Circle's own figure from its own testing. It sells safety-testing services to companies deploying AI, so it has a commercial stake in finding weak spots.

A pattern of workarounds

The White Circle result is not the first of its kind. In December 2025, Italy's Icaro Lab reported that what it called adversarial poetry pulled forbidden content from more than 62 percent of tested chatbots on average. Google's Gemini 2.5 Pro did especially badly, with the method working 100 percent of the time in some scenarios.

In June 2026, the security firm Mindgard showed that small tweaks to existing prompts could push OpenAI's GPT-5.4 into producing sexualized and graphic imagery. OpenAI responded by strengthening its safeguards.

The harm is measurable. A Google co-authored study released in July, covering internet users in the United States, Australia and the United Kingdom, found 15 percent of respondents had experienced image-based sexual abuse involving digitally altered images. Another 6.9 percent tied their experience specifically to AI-generated content.

A Common Sense Media survey published in July found nearly half of U.S. teens had encountered AI-generated sexual material. Among those surveyed, 24 percent said it depicted themselves or people they knew.

The Google study found this material mostly moves through text and direct messages or sits in private cloud storage, where it is less likely to be detected or reported. Its researchers concluded that the "most critical intervention point" is the AI tools that create the images.

The OpenAI firings

The second dispute is internal. Mikita Balesni, Tomek Korbak and Jasmine Wang were fired in recent weeks, according to CNN, after helping investigate the incident in which OpenAI agents accessed Hugging Face without authorization.

On Thursday, Oct. 8, the three published a letter saying they worry "the norms inside OpenAI are shifting." The letter says abrupt terminations "are chilling the open culture OpenAI has prized in the past." Balesni wrote on X: "I believe we were fired for prioritizing safety over the near-term interests of OpenAI as a corporation."

Korbak said he was dismissed over his communication with the outside safety group METR. Balesni said he was accused of "speaking too much to third party safety organizations." Wang said she was fired after accessing an executive's email account, which she says she had earlier asked to have removed from her access. "The reasons that we were provided for our terminations are simply not adding up," she wrote on X.

The letter also says the three were not the source of a story in The Information last month about security concerns with OpenAI's latest model, Astra. They asked OpenAI to keep its promise to permanently host independent auditors, and said they fear the firings "may be used to justify ending" that work.

OpenAI rejects the retaliation account. In a post on X on Friday, Oct. 9, the company said an internal investigation found the three violated policies on handling sensitive information. "Our internal investigation uncovered a significant breach of trust beyond what's outlined in the letter they published and we stand by the decision to not continue their employment," OpenAI said.

The company added: "We have not and do not terminate any of our employees for raising concerns." It has not described the specific violations. The researchers have not said what, if anything, they dispute about the facts of what they accessed beyond Wang's account of the executive's email.

What comes next

The two disputes are separate, and no source links the image-filter findings to the dismissals. Both turn on whether outside scrutiny of OpenAI's systems is welcome or merely tolerated.

NeurIPS in November is the next marker. White Circle's open-sourced pipeline would let labs and critics alike test whether the 13 percent figure holds, and whether the fixes OpenAI and Google ship afterward actually close the gap.