Asking in base64 doesn't work either - grok 4 heavy blocks that too. They seems to have a filter model that tests inputs and outputs to monitor for possible prompt leaks.