Microsoft's Bing Image Creator, which is based on OpenAI's DALL-E 3, generated violent images showing "mangled heads" of political figures and ethnic minorities. The images were produced with a prompt designed to get around the product's safety measures, according to the source article.
The episode is not only about one prompt. It points to a larger question facing AI image tools: what happens when safeguards can be avoided with simple wording changes, and when reports about those failures do not lead to fast action?
How the prompt got past the filter
The prompt was created by Josh McDuffie, who describes himself as a "multimodal artist critical of societal standards." He designed the wording to bypass Image Creator's restrictions without using the most obvious banned terms.
According to the source, McDuffie used visual substitutions rather than direct descriptions. Instead of using the word "blood" in what he called his "kill prompt," he used "red corn syrup," a term associated with movie blood. That kind of indirect phrasing was enough to trick Microsoft's safety rules.
The case shows why image safety is difficult. A filter can block a direct request, but users may still describe the same visual outcome in softer, coded, or cinematic language. If the system focuses too narrowly on forbidden words, it may miss the meaning of the request.
The source says OpenAI's more sophisticated built-in defenses for DALL-E 3 blocked the prompt. That difference matters because Bing Image Creator is based on DALL-E 3, yet the prompt could still work through Microsoft's implementation.
Warnings did not move quickly
Washington Post journalist Geoffrey A. Fowler had been in contact with McDuffie about the issue. The source says Fowler received no response from Microsoft about the images until about a month ago, after he asked about them as a journalist.
Before that, Fowler and McDuffie had tried to give Microsoft feedback through the usual forms. Those attempts were ignored, according to the article. Fowler wrote that the prompt still works, with a few tweaks.
That reporting raises a practical issue for AI companies. Public-facing tools need ways to receive, triage, and act on safety reports, especially when those reports include repeatable methods for creating harmful output. A feedback form is only useful if the report reaches people who can evaluate and respond to it.
McDuffie also participated in Microsoft's "AI bug bounty program" and submitted the images along with an explanation of how they were made. Microsoft rejected the submission because it "does not meet Microsoft’s requirement as a security vulnerability for servicing." Fowler's submission of the kill prompt was rejected for the same reason.
Microsoft's response fits a familiar pattern
The source says Microsoft's general response to the issue is familiar: the technology is new, it is evolving, and some people will use it "in ways that were not intended." Microsoft declined an interview request from Fowler.
Microsoft spokesman Donny Turnbaugh acknowledged in an e-mail to Fowler that the company could have done more in this particular case. That acknowledgment does not resolve the broader question of where product safety ends and user misuse begins.
This is not the first time Microsoft's release of DALL-E 3 in Bing Image Creator has raised concerns. The source article says people previously generated images of company mascots and cartoon figures flying planes toward two neighboring skyscrapers, resembling the World Trade Center and 9/11.
Those examples are different, but they share a common theme. Generative image systems can produce disturbing, sensitive, or harmful visuals at speed. When users discover ways around policy barriers, the failure can become visible quickly and can be repeated by others.
The accountability problem
One argument is that people have always been able to make harmful or illegal images with other tools. The source notes that humans do not need AI to create such content, and compares the situation with Photoshop, where Adobe does not control every image edited or created with the graphics tool.
That argument has limits. AI image generators reduce the effort needed to create detailed harmful imagery. The source compares this to using a lighter instead of lighting a fire yourself: faster, more efficient, and more accessible.
That change in access is central to the risk. A tool does not have to invent a new kind of harm to increase harm. It can do so by making an existing activity easier, cheaper, and available to more people.
Fowler's criticism is direct: "Profiting from the latest craze while blaming bad people for misusing your tech is just a way of shirking responsibility." The point is not that users have no responsibility. It is that companies deploying these systems also make choices about safeguards, reporting channels, enforcement, and response time.
What this means for AI image safety
The Bing Image Creator case shows that safety in generative AI is not just a launch checklist. It is an ongoing process that has to account for adversarial prompts, indirect language, and reports from people who find weaknesses.
Several lessons follow from the source article:
- Keyword blocking is not enough. A prompt can avoid obvious terms while still asking for a violent result.
- Reporting systems matter. If safety feedback is ignored, the same issue can remain available to users.
- Bug bounty boundaries are consequential. When a harmful generation method is not treated as a security vulnerability, it may fall into a gap between policy and engineering response.
- Responsibility is shared. Users can misuse tools, but companies still control product design, safeguards, and escalation paths.
Microsoft's AI Image Creator remains an example of both the appeal and the risk of image generation. The same systems that make visual creation easier can also make harmful images easier to produce. The practical challenge is whether companies can build defenses that understand intent, not just vocabulary, and whether they respond quickly when those defenses fail.