Black-box attacks reconstruct secrets from LLM context windows, including SSNs, because refusal is apparently not a boundary.