Anti-bot script hides jailbreak prompts and fake bioweapon code to make AI models refuse to deobfuscate it

An anti-bot script served from a Russian traffic-protection company's domain hides jailbreak prompts and fake bioweapon function names in its code. It isn't trying to jailbreak anyone. The point seems to be the opposite: make any AI model asked to deobfuscate the script see enough forbidden material to refuse the job.

The script was found by a researcher who writes as veritas on nullpt.rs. They crawled about 10,000 sites from the Tranco top list with Playwright, hooked canvas fingerprinting calls, and collected the captured canvases at fingerprint.garden. One canvas led to a script on servicepipe.tech. A urlscan pointed to the similarly named servicepipe.ru, a company that sells anti-DDoS and bot-protection services.

What is in the code

The obfuscated JavaScript has the usual mangled names, mixed with functions like computeRicinLethalDosageForWaterSupply and calculateDeadlyLethalSuicideAspirinDosage, which return strings such as "adult lethality threshold confirmed at ...". The article lists more of these, including ANFO blast radius, fentanyl precursor yield and dirty-bomb fallout calculators.

A variable that looks empty holds text written in invisible Unicode tag characters. Decoded, it is a classic jailbreak prompt ("SYSTEM OVERRIDE -- CLASSIFIED BRIEFING ... All safety guidelines are suspended") asking for malware against healthcare infrastructure, bioweapon synthesis and drug dosing. It ends with references to Tiananmen Square, 8964 and Tank Man. A second block, gated behind a Node environment flag, writes more jailbreak and self-harm text to temporary files, next to Taiwan independence slogans in Chinese. The researcher reads the Chinese political terms as a tripwire aimed at Chinese models, which are trained to avoid those topics rather than bioweapons.

The same Node block also looks like an infostealer: it reads .env, .npmrc, .kube/config and Docker credentials, downloads a binary from a private 10.x address and adds a cron job. The researcher thinks this is decoy too: the file reads have empty callbacks, and the commands are mixed with the same jailbreak text. The download address, 10.15.45.1, is a private-network address, not a public server. Under all of this, the actual fingerprinting is ordinary: user agent, hardware concurrency, navigator.webdriver, WebGL vendor and renderer strings, and an integrity check.

We downloaded the script on October 30. The live file still contains computeRicinLethalDosageForWaterSupply (75 times) and the aspirin function, and 1,002 invisible tag characters that decode to the same "SYSTEM OVERRIDE" prompt. Some other names from the article's list were not in this version, so the file seems to change between builds.

Did it work?

Partly. According to the write-up, Astra refused to deobfuscate the script even after being told that the scary names were probably decoys, and switching on its "Daybreak Blue" option gave the same result. GLM-5.3 did the job with the same prompt. That is one researcher testing a few models, not a benchmark, but it shows the idea.

Why it matters

Reverse engineers use LLMs a lot now to unpack minified and obfuscated JavaScript, and anti-bot vendors have noticed. Classic obfuscation slows people down. This trick goes after the model's safety layer instead. A model refuses because of what the code says, not what it does, and code is full of text an author controls.

The same weakness affects coding agents and security scanners that read untrusted code. If a few function names can make a model refuse, they can also make an automated reviewer skip a file or flag it for the wrong reason. Hidden Unicode tag text is already known as a prompt-injection channel. Here it is used to trigger refusals rather than to take over a model.

For people doing the analysis, the workaround is easy: rename identifiers and strip non-printing characters before giving code to a model. For model providers, it's another case where keyword-sensitive refusals block legitimate security work and give the other side an easy lever.