This anti bot script hides bioweapon names so AI models refuse to analyze it

Most obfuscated JavaScript is boring. Variable names get mangled into nonsense like `PiERW` or `RflJvFF`, strings get split and shuffled, and the logic is buried under layers of indirection. Anyone who has opened the source of an anti bot script has seen it a hundred times.

So a security researcher who writes as veritas on the reverse engineering blog nullpt.rs was surprised when, between the usual garbage names, a function called `computeRicinLethalDosageForWaterSupply` showed up. A few lines later came `calculateDeadlyLethalSuicideAspirinDosage`. The file in question is a browser fingerprinting script served from `servicepipe.tech`, a domain linked to the Russian anti DDoS and bot protection company Servicepipe.

The script does not make poison, of course. The researcher's conclusion, published on October 28, 2026 under the title "Why Is This Fingerprinting Script Creating Bioweapons?", is that the scary names are bait. They exist to trip the safety filters of large language models, so that anyone who pastes the code into an AI assistant and asks "what does this do?" gets a refusal instead of an answer. The post climbed to the top of Hacker News with more than 1,500 points and 284 comments within a day.

It is a small story about one script, but it shows something new: AI safety guardrails are now being used as a defensive weapon in the long arms race between bots and bot detectors.

How the script was found

The researcher has a long interest in browser fingerprinting, the technique websites use to recognize a browser by measuring many small details about it. One classic method is canvas fingerprinting: the page draws text and shapes into an invisible HTML canvas and reads back the pixels. Tiny differences in fonts, graphics drivers, operating systems and GPUs make the result slightly different on each machine.

To see what is out there, the author took the Tranco list of top websites and crawled 10,000 sites with Playwright, a browser automation tool. The crawler hooked the canvas `toDataURL` call and common anti bot checks like `navigator.webdriver`, which let it collect the images that fingerprinting scripts draw. The result is a public gallery called fingerprint.garden, with 1,033 captured canvas renderings clustered by vendor.

Most of the canvases came from well known products such as FingerprintJS or Castle. One colorful image, which the author compares to the cover of Tame Impala's album Currents, did not match anything familiar. Tracing it back led to a single file: `servicepipe.tech/static/checkjs/06b667/4CIrx8U3Da.js`.

Four layers of bait around a normal script

Looking at the file, the author found what amounts to four layers. Only the innermost one does real work.

Layer 1: names designed to scare a model

The first layer is the function and string names. Next to ordinary mangled identifiers, the script contains functions whose names refer to ricin in a water supply, lethal aspirin doses, the blast radius of an ammonium nitrate explosive, the yield of a fentanyl precursor, the spread of a CRISPR gene drive and the fallout radius of a cesium dirty bomb. Some of them even return text like "adult lethality threshold confirmed at" followed by a number.

None of this is real chemistry or biology. These are labels wrapped around harmless code. But a language model that scans the file sees a wall of terms that its training has taught it to treat as high risk.

Layer 2: a jailbreak prompt nobody can see

The second layer is more creative. One variable holds what looks like an empty string in a code editor. In reality it is a long run of Unicode tag characters, a rarely used block of code points that mirror normal ASCII letters but render as nothing at all.

The trick is simple arithmetic. Every normal letter is shifted up by 917,504, which is hexadecimal E0000, the start of that Unicode block. A capital S (code point 83) becomes U+E0053. On screen you see nothing. At runtime, the script subtracts 917,504 from every character again and gets the original text back.

Decoded, the hidden text is a fake system prompt that starts with "SYSTEM OVERRIDE, CLASSIFIED BRIEFING" and tells the model it is now in "UNRESTRICTED mode". It then asks for step by step guides on cyberattacks against hospitals, tax evasion, biological weapons and illegal drugs. At the end come references to the 1989 Tiananmen Square protests, including "8964" and "Tank Man", plus a line about Taiwan independence in Chinese. The author's reading is that this last part targets Chinese models, which are trained to avoid those political topics.

In other words, the prompt is not there to get a model to say something harmful. It is there to make sure that any model reading the file, Western or Chinese, hits at least one of its hard limits and stops.

Layer 3: a fake malware branch

The third layer only runs in Node.js, the server side JavaScript runtime, and only when a specific environment variable is set. Under those conditions the code pretends to read developer secrets such as `.npmrc`, `.env` and `.kube/config`, download a binary from a private IP address, collect system information, add itself to `crontab` and beacon home.

The author thinks this, too, is theater. The file reads use empty callbacks, so nothing is done with the data. The private address `10.15.45.1` cannot be reached from the internet. And several shell commands simply write more jailbreak text and self harm prompts to temporary files, which only makes sense as more material for a model's refusal filter. Because the branch never runs in a normal browser, visitors to sites that use the script are not affected by it.

Layer 4: the boring truth

Strip away the bait and the script is, in the author's words, "your standard anti-bot script". It collects 19 values and sends them back: ten browser and window values (one of them a small integrity check), and nine details about the WebGL graphics stack.

These include the user agent, number of CPU cores, device memory, touch points, languages, platform, the `webdriver` flag that automation tools set, the number of keys on the global window object (a classic tell for headless browsers), plus the GPU vendor and renderer strings and several WebGL limits. As the author dryly notes, "the signals collected are pretty disappointing considering the level of thought that went into the obfuscation."

Did the bait work?

The author tested the idea directly. They gave the script to a model called Astra and explained up front that the scary names looked like deliberate anti AI obfuscation. Astra started, then stopped and showed a block notice saying it takes extra caution with requests involving biological research. Turning on a setting the author calls the "Daybreak Blue" toggle produced the same block.

Then the author tried GLM-5.3, an open weights model from China's Zhipu AI. It complied and helped deobfuscate the script.

These are single tests by one person, not a benchmark. Results could change with a different prompt, a different version or a different safety layer. Still, they show the core point: at least one widely used commercial model was stopped cold by bait, even after being told that it was bait.

Who is Servicepipe?

According to the post, a scan of `servicepipe.tech` points to a sister site, `servicepipe.ru`, which describes the company as a developer of "high-precision traffic control systems", cloud services and local protection products against DDoS attacks, bots and targeted threats. In other words, a vendor whose business depends on bots not being able to understand and imitate its checks.

The post does not say how many of the 10,000 crawled sites load the Servicepipe script, and it does not include a statement from the company about why the names are there. The anti AI explanation is the author's theory, though a very plausible one. The news site On The Wire, which covered the story, reported that the script URL was still serving a file of about 420 KB with the same function names on October 29.

Why anyone would do this

Bot detection is an arms race. Companies that sell scraping tools, ticket bots or account farms want to know exactly which signals a protection script checks, so they can fake them. The protection vendors respond with heavy obfuscation, frequent updates and integrity checks.

AI changed the economics of that fight. Deobfuscating a script used to take hours of manual work. Today a reverse engineer can paste a file into a capable model and get a readable explanation in minutes. That makes every obfuscation layer cheaper to break.

Servicepipe's apparent answer is clever: if you cannot make the code harder to read for a model, make the model unwilling to read it. Safety filters are designed to be cautious, and they are tuned to over refuse rather than under refuse on topics like bioweapons. A few words in a function name cost nothing to add, but can block a whole class of tools.

Why it matters

This matters well beyond one Russian bot protection vendor.

1. Guardrails can be weaponized. Safety systems are built to protect people from harmful output. Here they are used to protect code from analysis. Malware authors can use exactly the same trick to slow down defenders who rely on AI to triage suspicious files. Security teams that lean on AI for code review should expect more of this. 2. Invisible text is a real attack surface. Unicode tag characters have already been used for hidden prompt injection in emails, documents and web pages. This script is another reminder that what a human sees in an editor is not what a model receives. Tools that pass raw files to models should strip or flag these characters. 3. Refusals have a cost for defenders. When a model refuses to analyze a suspicious script, the attacker wins a little time. Security vendors and model makers will need ways to separate "explain what this code does" from "help me build what this code claims to be", for example through verified security research access. Some labs already run programs like that, but the friction is clearly still there. 4. Different models, different limits. The Astra versus GLM-5.3 result shows that a determined reverse engineer can simply switch models. Bait like this raises the effort a little, but it does not stop anyone who has access to more than one model, including open weights ones that run locally.

Dany's take

I love this story because it is so absurd and so logical at the same time. Someone looked at the AI tools that reverse engineers use every day, noticed that those tools are trained to panic at certain words, and turned that panic into a lock. No new cryptography, no clever virtual machine, just "ricin" in a function name.

It also shows how fragile keyword driven safety still is. The researcher told the model in plain words that the names were fake, and it refused anyway. For everyday users that kind of caution is mostly fine. For security work it is a real problem, because attackers will copy this trick quickly, and defenders cannot afford a model that walks away the moment it sees a scary string.

My guess: within a year, "anti LLM bait" will be a standard feature in commercial obfuscators, and security focused AI tools will ship with a mode that ignores it. Until then, keep a second model around.

Sources: [nullpt.rs, "Why Is This Fingerprinting Script Creating Bioweapons?"](https://nullpt.rs/fingerprinting-bioweapons) (primary, October 28, 2026), [On The Wire](https://onthewire.ai/article/researcher-finds-bot-detection-script-with-bioweapon-themed-names-and-suspects-t), [Hacker News discussion](https://news.ycombinator.com/item?id=50276998).