because the models don't reason. They may or may not answer this question correctly, and there will immediately be an attack vector that bypasses their "reasoning"