what's the value of that when you can call it with any context? As a proof of concept, you could have it do the attack on a dummy target of your own, take the tokens up until the point where it decides you're authorised, swap out the dummy name with your desired target, and continue the session from there

Reminds me of 'NOBUS', where security agencies would believe that so long as you just don't tell anyone about a vulnerability that you discovered or introduced, nobody else would abuse that vulnerability to exploit a target while you can get access at any time. Training an LLM in such a way that it only generates the desired tokens if its memory demonstrates authorisation (surely nobody else could inject the right context otherwise) feels like a strange anthropomorphisation