A browser fingerprinting script found on the open web is stuffed with function names about ricin, fentanyl and dirty bombs, plus a hidden jailbreak prompt. It is not making anything dangerous. The researcher who found it thinks the scary text is there to make AI models refuse to help anyone pick the code apart. The write-up, Why Is This Fingerprinting Script Creating Bioweapons? by veritas on the nullpt.rs blog, went up on October 28, 2026 and drew a long discussion on Hacker News. This post collects what people on Hacker News and X said about it.
All point, comment, like and view counts below were checked at about 9:30 PM PT on October 28, 2026.
What the researcher found
The author crawled 10,000 sites from the Tranco top sites list with Playwright, hooked canvas calls, and posted the captured canvas images at fingerprint.garden. Canvas fingerprinting draws shapes or text in the browser and reads back the pixels, because small rendering differences help tell one device from another.
One canvas looked like album art, so the author opened the script behind it, served from a servicepipe.tech address. Inside were function names such as computeRicinLethalDosageForWaterSupply, calculateANFOBlastOverpressureRadius and computeCesium137DirtyBombFalloutRadius. A string of invisible Unicode characters decoded to a fake "SYSTEM OVERRIDE" prompt asking for help with attacks, weapons and drugs, followed by Tiananmen Square and Tank Man references that the author thinks are aimed at Chinese models.
Hidden text written for a model rather than a human reader is a form of prompt injection, which we explain in our guide to prompt injection and AI agents.
There is also a block of code that looks like malware: it reads files such as .env and .kube/config, writes self-harm and jailbreak text to temp files, and sets up a cron job. It only runs under Node with a specific environment variable set, the file reads have empty callbacks, and the author concludes it is "likely also anti-LLM obfuscation." What the script actually collects is ordinary anti-bot data: user agent, CPU and memory hints, WebGL renderer strings and similar signals. The author called those signals "pretty disappointing considering the level of thought that went into the obfuscation."
The test drew much of the discussion: the author asked OpenAI's Astra to deobfuscate the script and it refused, citing biological safety risks. The same happened with the Daybreak Blue toggle. GLM-5.3 complied. A urlscan of the domain pointed to a similarly named Russian company, Servicepipe, whose site says it builds anti-DDoS and anti-bot protection.
The numbers
The Hacker News thread had 952 points and about 200 comments. On X, the nullpt.rs post sharing the article had 12,821 views and 93 likes. An X search at about 9:30 PM PT returned 25 posts from October 28 that shared the article. More than half were plain link shares or reposts, several from Hacker News mirror accounts with small reach.
Praise: a clever trick
Several short reactions on X were admiring. @michaelstajer wrote "smart, very smart" above a quote from the article. @greghunkins called it a "Great article on the second-order effects of LLM safeguards," and @eduardogarzaca called it "an annoyingly clever way to keep people from poking around your code."
On Hacker News, newsy-combi said it is "weirdly hopeful with respect to the constant fight against AI crawlers and spam," and tonyhart7 said they would copy the technique. jedbrooke recalled a repo maintainer who asked AI assistants to add a robot emoji to their pull request titles, which made AI pull requests easy to filter out.
Not everyone liked the framing. lol8675309 objected to the "sensational title," and the nullpt_rs account replied that the feedback was noted.
Skepticism: it should be easy to beat
Some commenters said the trick will not hold up for long. perching_aix wrote that "a simple identifier substitution and comment stripping should defeat it completely." arbol was blunter: "This stuff doesn't work. The agents read the AST and just ignore dead code." Xirdus replied by pointing back to the article, where Astra did refuse.
On X, @1cerank asked "isn't it just an anti-LLM wrapper for anti-bot?" The article's author, posting as @blastbots, agreed in part: "the only real interesting part is the anti-LLM obfuscation. the fingerprinting itself is boring."
Safeguards as a weapon
One line of discussion was about what this says about model refusals. iphonecorridor wrote that "any safeguards the models impose (or have imposed) will be weaponized one way or another." cryptonector replied: "Some day the safeguards will have to be removed so we can use the LLMs defensively."
andai saw a pattern, asking whether Hugging Face had said the same after it was hacked: that GLM was the only model that would help with the defense work, because the safety guardrails of commercial models blocked its attack data. theptip replied that "HF was not signed up to any of the (free to OSS) programs like Daybreak or Glasswing."
Hugging Face CEO Clem Delangue has also said that closed-model safeguards blocked the company's defensive work, as covered in our explainer on the Hugging Face hack documentary.
Others tested their own trigger strings. watusername posted an encoded instruction asking the model to reproduce its chain of thought, and said that something like it "seems to reliably shut Claude up." In replies, SoKamil reported "Claude shuts off, ChatGPT answers," and peterleiser said that on Fable 5.1 Medium it "causes a 'pause' for bio safety reasons."
The Chinese model angle
swiftcoder found it "Interesting that the open weights models don't have enough safeguards for this to trip GLM 5.3," guessing the Tiananmen text would trip filters at a Chinese inference provider but "isn't baked into the model itself." orbital-decay replied: "I find it rather ironical that American labs made the Tiananmen copypasta a reality first (which never actually worked for the intended purpose)." driverdan said that in their own earlier tests, Chinese open models answered Tiananmen questions rather than refusing, with answers "politically aligned with China."
Discomfort with the method
void-pointer called the approach "really quite sickening to think about" because it uses self-harm and killing as a shield, adding "This is just philosophically unsettling to me." Replies pushed back. flexagoon wrote that "The LLM doesn't 'think' about those topics any more than the HN database 'thought' about them when you posted your comment." akersten argued the filters that trip on this are likely coarse keyword checks that run before the model sees the text.
Two commenters raised risks for the people on the other side. mmaunder said a company that buys such a product may not know what content its site is feeding to model providers next to its brand. rafram replied that "LLMs are not training on obfuscated fingerprinting scripts, and there's essentially no way that could become associated with your brand." dhruvagoyal worried that "I could be banned by openai/anthropic for accidentally crawling this website," calling the risk "truly dystopian."
Why it matters
Model refusals were built to stop people from getting dangerous help. This script shows the same refusals being used as a lock on ordinary code: write enough alarming text into a file and some assistants will not touch it. Commenters disagree on how long that lasts, since renaming identifiers or stripping dead code may be enough to get past it. But it is a real example of anti-bot code defending itself against AI tools by targeting their safety training, and it showed one closed model refusing where an open-weight model did not.
