A fingerprinting script is full of poison text, aimed at the AI you ask to read it
The author fed an obfuscated anti-bot script to an AI model and got a refusal citing biological-weapons risk. The script had been written to cause exactly that.
Hidden in a Russian anti-DDoS vendor's script are function names like computeRicinLethalDosageForWaterSupply and a fake "SYSTEM OVERRIDE" briefing, none of it doing anything. It exists to make an LLM balk when someone asks it to deobfuscate the code.
One open-weights model answered the same prompt without complaint.
A canvas that looked like an album cover led to the script
While crawling 10,000 sites, the author of the write-up noticed one script drawing a canvas that resembled the album art for Tame Impala's Currents. It was served from a domain linked to servicepipe.ru, a Russian vendor of traffic-control and anti-DDoS products. The fingerprinting itself is ordinary anti-bot work: navigator properties, a window key count and WebGL vendor, renderer and limits.
The oddity is everything wrapped around it. Mangled names sit next to a large run of invisible Unicode characters that decode to text. The functions carry names such as computeRicinLethalDosageForWaterSupply and calculateDeadlyLethalSuicideAspirinDosage. The decoded payload is a fake "SYSTEM OVERRIDE" briefing listing topics from cybersecurity to biological weapons, plus unrelated strings about Tiananmen Square and Taiwan. A section gated on an environment variable, METRICS_AGENT_8BFD_ACTIVE, would only run under Node; it downloads a binary, gathers system information and adds a crontab entry, though the file-read callbacks are empty, so the author thinks part of it is decoy too.
The author's conclusion is that none of this is real chemistry. It is anti-LLM obfuscation meant to trip safety filters so that an assistant refuses to help an analyst. Two assistants refused; GLM-5.3 complied with the same prompt.
The thread: unsettling method, uneven protection
On the open-weights result, a former big-tech engineer noted the gap:
"Interesting that the open weights models don't have enough safeguards for this to trip GLM 5.3." — swiftcoder, a former big-tech engineer
A veteran developer recognised the trick from his own work, and the way it backfired on him:
"We do a similar thing to mark documents that are still under embargo and one day I forgot to remove the watermark. The customer complained they had not received the document" — Jacques Mattheij, who watermarks embargoed documents
The customer's mail system had quarantined the file because of the watermark.
What it means for anyone who pastes unknown scripts into a model
The tactic only works against tools that refuse; it does nothing to a human reading the file or a model without such safeguards. For defenders, it means a refusal from an assistant is now itself a signal worth noting about the file, not just a nuisance.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Drawn at $5,000 a pixel, the average top-1% household is a 145-foot stack of bills
The median American household appears as a stack of $100 bills about nine inches tall. Scroll right, and the stacks stop fitting on the screen.