The goalpost here is pretty specific: a couple hundred people try for 4,000 hours to figure out a "universal jailbreak" which means it converts the model to one

The goalpost here is pretty specific: a couple hundred people try for 4,000 hours to figure out a "universal jailbreak" which means it converts the model to one that answers all 10 of a set of "forbidden" questions. Since they couldn't, the technique is considered robust. Looking at the data though, there apparently exist jailbreak techniques that make the model answer five of the questions at full detail, and nine at "half detail". Given that the model would ostensibly be deployed to millions of people who would collectively use it for millions of hours, I'm not sure how confident I am that the 10-question barrier would remain unbroken for long.