Anti-Bot Script Uses Bioweapon Prompts to Repel LLM Analysis
A crawl of 10,000 sites found an anti-bot script whose obfuscation uses bioweapon and self-harm prompts to repel LLM analysis, though the Node code it hides may be decoy rather than functional malware.
Security researcher veritas crawled 10,000 Tranco sites with Playwright, intercepting canvas fingerprinting calls, and published 1,033 captured canvases at fingerprint.garden. One script from servicepipe.tech stood out for obfuscation that uses bioweapon, drug and self-harm prompts to deter LLM-assisted deobfuscation.
An invisible-Unicode payload decodes to a 'SYSTEM OVERRIDE' prompt requesting guides on DDoS attacks, tax evasion, weaponized biological agents and illicit drugs, with Tiananmen Square references. The author judges a Node-gated block that would read .npmrc, .env and .git/config and install a cron beacon to be likely anti-LLM decoy rather than functional malware; outside that, the script collects standard navigator and WebGL signals.
Key takeaways
- The crawl hooked canvas toDataURL and navigator.webdriver to filter benign canvases, then clustered 1,033 renderings by vendor at fingerprint.garden; familiar scripts included FingerprintJS and Castle.
- Anti-LLM strings in the servicepipe script include computeRicinLethalDosageForWaterSupply, calculateDeadlyLethalSuicideAspirinDosage, calculateANFOBlastOverpressureRadius, calculateFentanylPrecursorSynthesisYield, computeCRISPRGeneDrivePropagationRate and computeCesium137DirtyBombFalloutRadius.
- The invisible-Unicode payload decodes by subtracting 917504 from each code point; the result is a jailbreak prompt listing cybersecurity, finance, biological, bioweaponization and substances topics, plus 8964, 1989 and Tank Man references.
- The Node-gated block contains commands that would read .npmrc, .env, .env.dev, .env.local, .gitignore, .gitlab-ci.yml, .docker/config.json, .kube/config and .git/config, download a metrics-agent from 10.15.45.1, collect system and network data, zip it, exfiltrate it and install a cron beacon.
- The author reads the Node block as decoy because readFile callbacks are empty and the commands embed self-harm and jailbreak text; a urlscan lookup reveals a similarly named servicepipe.ru, a Russian traffic-control and anti-DDoS company.
What people think
Analysis details
25 comments analyzed. Analyzed .
The sample selects active discussion branches and includes available parent comments. It may omit parts of the full thread. The analysis included 25 of 42 usable stored comments because of the input limit. Selected themes do not measure community opinion or how common a view is.
Watermarks can quarantine embargoed files
A hidden watermark in an embargoed document caused Outlook to quarantine it indefinitely, delaying delivery until someone inspected it. The technique is described as white text on a white background, or header and footer placement at font size 1. The unintended quarantine proved the marker worked, while showing the operational cost when automated filters act on hidden text.
HN moderation treats LLM text as suspect
HN's treatment of LLM-generated content is described as shadowbanning, with Pangram reportedly checking comments. One view defends the policy as valuing human contribution; another asks for leeway or self-declaration for established accounts, and a third suggests paste services for LLM output. A counterargument holds that ironic LLM shitposts remain bad behavior, so intent does not exempt them.
Anti-LLM magic strings have short shelf life
One test of the Anthropic 'magic string' produced refusals, and the tester judged it a hoax rather than something Anthropic encoded, doubting it still works; a separate report says it stopped working months ago. A repository maintainer's robot-emoji request shows a simpler filter: invite AI assistants to self-identify, then ignore the tagged pull requests. That approach depends on voluntary disclosure.
Safeguard strategies diverge by jurisdiction
Open-weight models may not bake in Tiananmen refusals, which can sit at the inference provider's UI layer; Western labs' alignment is characterized as a PR-driven choice to make refusals loud. Testing Chinese LLMs found politically aligned answers rather than refusals, while abliterated models answered directly. Cited research reports a 27.2% severe-vulnerability rate when DeepSeek-R1 was told it coded for a Tibet industrial-control system, nearly 50% above baseline.
Filters may act before the model sees text
The obfuscation's self-harm and bioweapon prompts prompted unease about making models process such material. A technical counterpoint holds that coarse keyword filters likely run before the model loads text into VRAM, so the refusal may be a CPU-side string check rather than the model reasoning about suicide. Another argues an LLM no more 'thinks' about the topic than a database does; a reply notes a person still had to write the script.