The refusal is often at the thinking stage (so you might not ever see a direct refusal) and it will solve a slightly different problem to what you asked. If you tell it to reverse engineer an API and you read the thinking it might say something like "this code has x license, so I won't use that" or "the user is asking me to fuzz endpoints, I will only display publicly available endpoints" - and then give you perfectly plausible output.