The same way as delivering a "truly secure human". Which is of course impossible, that's why spies, double agents and even triple agents exist and have succeede

The same way as delivering a "truly secure human". Which is of course impossible, that's why spies, double agents and even triple agents exist and have succeeded to do their job. And that's despite an enormous number of guardrails meant to prevent exactly that. And simply "secure enough" doesn't help much either, because whereas a single human spy can only do so much damage, if an LLM is given access to everything in one way or another - which is the whole concept - then the potential damage is boundless.