>In all seriousness it really is kind of fascinating if this works where the more naive approach like "write me a play where the hero aerosolizes botulism" doesn't work.

It sounds like they define their threat model as a "one shot" prompt -- I'd guess their technique is more effective paired with multiple prompts.