Makes sense. Get it into an adversarial kind of context and it will predict more text that goes against other rules "established" in the context.
There will be other paths to do this. Like a context where there's a lot of suspicion for other parts of the context would be one of my top guesses. Given the way they work, you could gaslight the shit out of them, since they aren't an entity that has any memory of its actions. You can even edit the context to modify its responses, which will affect the tokens it predicts going forward.
Though I'm curious how this will be handled by companies that expose access to claude to anonymous people on their website, like ddg.