The "bare eval text" is still augmented with system prompt and fine-tuning, which could be tweaked (perhaps without this specific intent) in experimental settings. And the "shape" of exploiting a remote service to gain local privilege will have been in training data.
