Image models' real bypass rate is about 13%, not 30%
A red-team study lands with an awkward number for both sides of the image-safety fight, a quantum computer hands its lasers to an agent, and a Bengaluru chemicals startup bets AI can loosen China's grip on rare materials.
The real bypass rate on the big image models is about 13%, and the widely quoted 30% figures do not survive a better judge. A preprint from White Circle, a safety-monitoring firm, introduces RISE — Red-teaming via Iterative Strategy Evolution — which evolves reusable attack strategies rather than rewriting prompts one at a time, then reuses the winners against new scenarios. Across DALL·E 3, Google's Nano Banana 2, and GPT-Image-2, RISE reached up to 13% human-verified attack success, using a publicly available abliterated Qwen model as the attacker and no fine-tuning. The second finding is the sharper one: when the authors re-scored prior red-teaming methods under category-specific success criteria calibrated against human labels, reported success rates as high as roughly 30% fell to close to zero. Some of that gap is real hardening — vendors patch the seeds that show up in papers — and some of it was judges counting borderline benign images as wins.
Why it matters: policy fights over generated sexual imagery are now fought with these percentages, and the same miscalibration cuts both ways — it flatters attackers in some papers and flatters models in others. Independent data shows the harm is not hypothetical. The Internet Watch Foundation logged 6,310 AI-generated child sexual abuse images in the first half of 2026, about 40% above the 4,512 it found in all of 2025. A Google co-authored survey of 7,231 people in Australia, the UK, and the US found 3.2% self-reporting they had generated or shared AI sexual imagery, and 18% saying they had viewed it.
Disclosure worth naming: the preprint is vendor work, published on arXiv on September 28, with a commercial interest in detection techniques working. Treat the 13% as the best current estimate, not a settled one.
QuEra taught Claude to hold and tune the lasers its quantum computer runs on, and reports it beats a human specialist. The Boston firm's neutral-atom machines need their lasers held within about ±1 kHz; drift, vibration, and pressure push them off target continuously, and a bad enough disturbance knocks the laser into the wrong mode — it looks locked and isn't. Recovery used to mean a scarce expert, sometimes at 2am in the lab. Working through the Model Hardware Standard, the Anthropic and HHMI Janelia spec for agents that drive lab instruments, an agent with control of roughly $700,000 of hardware inside human-set safety bounds recovered correctly in 695 of 700 timed trials, 99.3%, in 0.9 to 5.4 seconds for common faults against five to ten minutes for a person. Left unattended overnight, it also cut residual frequency noise fivefold and suppressed a 220 kHz resonance that a manual tune had missed.
The framing that matters: what ships to the bench is a deterministic, inspectable script, not a live model. The agent wrote and validated it; a human stayed in the orchestrator's seat. That is the honest version of "AI runs the machine."
Scimplify raised $25 million to shorten the path from a promising molecule to a shipped specialty chemical. The Bengaluru CDMO, founded in 2023, uses its Scinode platform — specialized agents for research, manufacturing route selection, and quality control — to coordinate production across more than 500 partner factories. It says Scinode has taken some orders from customer requirement to delivered material in two months, against a 12-to-18-month norm. Hitachi Ventures led the all-equity round, with customers Henkel and Teknor Apex joining as investors; a person familiar put the post-money valuation at $250 million, up from $150 million after a March 2025 Series B. Total equity funding is $80 million, which the company confirmed, while declining to disclose the valuation itself.
Scimplify is working on tungsten derivatives from scrap and on rare earths — two categories where supply runs through China — and says its US revenue run rate rose sixfold to about $60 million in a year, on an overall run rate near $200 million. Corporate press can dress up almost any supply-chain pitch; the test here is whether a customer outside India can qualify a non-Chinese material at acceptable cost. That is a slow, unglamorous question, and it is the one worth watching.
If a guardrail's published bypass rate can swing that far depending on the judge, should vendors have to disclose both the number and the eval that produced it? Tell us in the comments.
