It's trivial to bypass this by tweaking the system prompt in other harnesses. They use string matching and a blacklist.

https://x.com/FlorianKluge/status/2041855675295318039

(Whether that's against the ToS is not clear.)