You can turn off the browser use tool in the harness if an instruction not to use it for this is not enough.
I hope that in the future they can differentiate better when something is constrained intentionally, rather than persistently working around every blocker it encounters.