Why would it be strange or harder? The initial prompt can contain as many layers of inception-style contrivance, directed at as many inaginary AI "roles", as t

Why would it be strange or harder? The initial prompt can contain as many layers of inception-style contrivance, directed at as many inaginary AI "roles", as the attacker wants. It wouldn't necessarily be harder, it'd just be a prompt that the attacker submits to every AI they find.