You have to try a bunch of times. Most of the times it catches it. Same old boring jailbreaking using subtle wording to constrain the possible outputs, that has always happened.