It’s called the waluigi problem and is also part of the reason why you can never fully “censor” an LLM; there is always some jailbreak possible