Nice experiment, but I'd temper the optimism. "Zero breaches in 6k attempts" is a success-rate estimate, and the model is nondeterministic, so a failed jailbreak isn't proof it's blocked, just that it didn't fire on that sample. 6k different prompts isn't 6k tries of the worst one; an attack with even a 0.1% success rate usually shows zero in a handful of attempts, and the tail is what bites in production. Also, this is direct user injection, the easy case. The channel people actually lose to is indirect: untrusted content arriving via a tool result or fetched doc, which Fiu never had in the loop.

Is there a way to replay the sequence of mails that came so that you can check out if cheaper models handle them just as well/safely?

Every time I've made an LLM do a thing it's designed not to do it's been a careful sideways crab-walk toward the goal over many exchanges. LLMs are vulnerable to 'frog boiling'. If each email is a new context it seems unsurprising that nobody broke it.

how much of the win was the model versus the constraints?