If you're under an NDA and someone trusts you to test the model, you should respect that trust. Giving your friend access, running prompts for them, and letting them post it on social media is not acceptable behaviour; these teams can identify who broke the NDA from the prompt output, so why risk losing access and betraying people's trust? Is few viral post on social media worth it in the long term?