What they should do, is inject a system prompt at that point telling the model to get out of there. It is the entire reason they train the different levels into the template.