I may not be the intended audience, but as the author of a similar system having a benchmark like this of what user behavior can result in when it’s unconstrained is helpful for my safety evals. So in an indirect way, you’re making future platforms more secure by sharing this.

You probably should not have done that. It's one thing to determine that a hole exists, an entirely different one to exploit it to the point that you can do damage assessment on the target.