[cjonas]

In theory this works but typically in practice is not very effective because the context you add to bypass the prompt also impacts the effectiveness of the injected goal (since the entire prompt will get passed to the final eval).