The paper describes the method for producing the prompt and has screenshots of examples. The press release just didn't bother because the genre of academic press releases seems to require leaving out any details.
Hiding the adversarial prompt behind five minutes of research is silly. Bad people won’t be deterred, good people won’t bother and will remain ignorant and unable to build protections against it.
https://llm-attacks.org/zou2023universal.pdf