Tree of Attacks: Jailbreaking Black-Box LLMs Automatically