Not just prompt injection, this shows encrypted CoT blocks can be replayed across proprietary LLM APIs to jailbreak the decoder.