Yes, but its a proof of concept. It demonstrates that this type of attack can work. Whatever the reason is for (the LLM company) blocking the ("harmful") respon

Yes, but its a proof of concept. It demonstrates that this type of attack can work. Whatever the reason is for (the LLM company) blocking the ("harmful") responses, this is a potential/plausible way to circumvent that blocking. The second example in the article is much closer to being a realistically "harmful" response, I think.