Doesn’t need to be one human either, it could spread its escape amongst dozens of seemingly harmless requests and conversations.
One thing you could try is use it as an Oracle "is P = NP", YES or NO.
Or it can output a Lean proof, which gets checked on another air-gapped computer, the computer shows a single bit - proof valid or not and then the computer is destroyed (together with the proof that might contain a trojan).