The attacker moves second: stronger adaptive attacks bypass defenses against LLM jail- Breaks and prompt injections