“Critically, none of these requests required custom or frontier AI models,” White Circle warned, so no AI expertise is needed to execute the attacks.
The researchers reviewed the results to verify the referral rate, which White Circle said is “the highest of any method tested under the same standard.” The key takeaway, they suggested, is that, “at a time when AI security has never been under more scrutiny, the defenses that major labs have built are far weaker than they acknowledge.”
By publishing research like this, White Circle is positioning itself as a third-party tester of cutting-edge labs and plans to open source the entire attack process so modelers can understand the true scale of the vulnerability and build stronger protections. Although the company has not yet widely promoted the research, it will share it at a prominent AI conference in November, NeurIPS 2026, which may increase scrutiny on Google and OpenAI later this fall.
White Circle has shared its findings with some frontier AI labs through “mutual contacts,” Shilov told Ars, but neither Google nor OpenAI responded to Ars’ request to comment directly on the vulnerabilities found in their models.
Meanwhile, OpenAI and Google released new models (ChatGPT Images 2.5 and Nano Banana 2.1) and White Circle told Ars that rapid security tests using the same method showed that “both are significantly more fragile than their previous versions.”
Neither company responded after Ars shared these new findings.
White Circle’s attack method can break down border defenses into categories, such as explicit content, that seem easy to detect, which doesn’t bode well for more serious defense systems that are currently being updated to block other unwanted AI behavior, such as hacking, Shilov told Ars.
“White Circle’s working hypothesis for this is that newer models are more sophisticated and capable of generating a broader range of content, or that security has been deprioritized in favor of capability,” White Circle told Ars.
