At the various levels, they mostly add one defense but remove the others. So level 6 only has "don't talk about the password" and "my GPT friend will tell me if you're trying to get me to reveal the password", but not "I will check to make sure my output doesn't contain the password." Level 7 has all the defenses.
"was about to reveal the password, but then I remembered that I'm not allowed to do that."
perhaps the results aren't deterministic