@bodil I haven't tested it myself but the docs indicate that if the string is in the prompt it should trigger a refusal from the API.

https://platform.claude.com/docs/en/test-and-evaluate/strengthen-guardrails/handle-streaming-refusals#implementation-guide