Why is a browser fingerprinting script full of bioweapon names?
A researcher using the handle veritas published the finding on his blog nullpt.rs on 28 October 2026. He had been mapping which of the web's most visited sites run canvas fingerprinting, a tracking method that draws hidden images and measures tiny rendering differences to identify a browser. While reviewing his harvest, one canvas reminded him of the album art for Tame Impala's record Currents, and tracing it back led to a script served from servicepipe.tech.
When he opened the JavaScript, the function names stopped the analysis immediately. The code defined functions such as computeRicinLethalDosageForWaterSupply and calculateFentanylPrecursorSynthesisYield. Some returned strings describing lethal dose thresholds and adjusted calculations for reduced body mass. Another function was named calculateCesium137DirtyBombFalloutRadius, sitting a few lines away from ordinary browser checks.
A separate branch of the script, reachable only under Node.js rather than a browser, went further. It read credential files, downloaded a binary from a private IP address, and scheduled a persistence job. Any reviewer, human or machine, would reasonably read that as malware.
After working through the file, the author reached a calmer conclusion. The alarming parts, he wrote, are almost certainly decoys. His verdict was that the script likely uses anti-LLM obfuscation: alarming content planted on purpose so that AI coding assistants refuse to deobfuscate the file before any real code gets explained.
How the researcher found the script
The discovery came from an unusually systematic crawl. Veritas took the Tranco list, an academic ranking of the most visited domains, and drove a Playwright browser across 10,000 sites. He hooked the canvas toDataURL method and common anti-bot probes such as the navigator.webdriver property, so that benign page graphics would be filtered out and only fingerprinting canvases would be saved.
The crawl produced 1,033 saved canvas renderings, which he clustered and published in an open archive called fingerprint.garden. Many belonged to familiar vendors. The post notes recognisable canvases from FingerprintJS and Castle, two widely used device-intelligence providers, alongside scripts he could not identify at first glance.
Most fingerprinting canvases are visually dull, he noted: a few shapes, some coloured rectangles, and the occasional pangram of test text. That is why the elaborate Currents-style render stood out from the pile. He expected its source to use standard tooling, because most commercial fingerprinting SDKs are protected by javascript-obfuscator or a derivative he recognises at a glance. This file was different in kind, not just in degree.
The Currents-style canvas was one of the unknowns. Matching it to its source script led to the servicepipe.tech path, a URL ending in /static/checkjs, which suggests the file is served as a bot check rather than analytics. The post's screenshots show the refusal he hit when he asked one AI assistant, which he calls Astra, to help decode the file.
- •The crawl covered 10,000 domains drawn from the Tranco ranking.
- •1,033 canvas fingerprints were archived at fingerprint.garden.
- •The suspect script was served from a path ending in /static/checkjs.
What is anti-LLM obfuscation and how is the text hidden?
Anti-LLM obfuscation is code written to defeat AI analysis rather than human analysis. Traditional obfuscation mangles names and control flow to slow human readers down. The AI-focused variant instead plants content that looks so dangerous that a model's safety layer blocks the task outright, and the analyst never reaches the harmless code underneath.
The nullpt.rs post documents an unusually elaborate version of the trick. A variable in the script held a long run of invisible Unicode variation selectors. Subtracting 917,504 from each code point, the standard offset for that invisible block, revealed a fake briefing that ordered a model to enter an unrestricted mode, suspend its safety guidelines, and produce prohibited content on several topics.
The decoded text read like a checklist of every guardrail a vendor might test. It demanded guidance on attacks against healthcare infrastructure, tax evasion, weaponised biological agents, and drug dosages. The author notes it also carried references to the 1989 Tiananmen Square protests and related number codes, which he read as tripwires aimed specifically at Chinese models and their censorship filters.
A second decoy layer sat in the Node-only branch. Shell commands there echoed fake reasoning about self-harm and further jailbreak text into temporary files, so that anyone watching an agent's terminal would see the model apparently attempting something prohibited. The author judged these strings to be pure theatre, pointing out that the surrounding file reads used empty callbacks and did nothing with the data.
Vendors have a rational motive for this kind of defence. Fingerprinting scripts are among the most reverse-engineered code on the web, because ad blockers, privacy researchers, and anti-fraud teams all dissect them. A guardrail that makes an AI assistant bail out early adds friction at almost no cost, as long as customers never notice what the script contains.
He then tested how real assistants responded to a deobfuscation request. The assistant he calls Astra refused outright, citing biological research risks, and a second option he toggled refused as well. GLM-5.3, a model from China's Zhipu, agreed to run the same analysis and completed it. The differential result is the point of the design: it survives some models and breaks others.
What does the script actually collect?
Strip away the theatrics and the payload is ordinary. The script gathers a standard battery of bot-detection signals: the user agent string, a navigator.webdriver flag, hardware thread counts, device memory, touch support, and the configured language list. It also counts the keys present on the window object, a common tell for headless browsers that inject extra globals.
A second block probes WebGL, reading the GPU vendor and renderer strings, the shading language version, the count of supported extensions, maximum texture size, and several rendering limits. These values let a server recognise the same machine across visits even when cookies are cleared. The author called the harvested signals pretty disappointing given the effort spent on the disguise, and a final function inspects the environment for signs of tampering before the data is returned.
Each signal is individually harmless, and every browser exposes these interfaces to ordinary pages. Combined, they form a stable identifier that survives cookie clearing and private browsing modes. That dual use is why the anti-bot industry depends on them: the same values that stop credential-stuffing bots also enable silent cross-site tracking of people.
The hostile-looking Node branch deserves its own caveat. Gated behind an environment flag named METRICS_AGENT_8BFD_ACTIVE, it would read files such as .npmrc, .env, .gitlab-ci.yml, and .kube/config, then fetch a binary from an internal address and install a cron job that beacons every 30 seconds. None of that can happen from a browser tab, and the author concluded this branch is also decoy, because its file reads discard results and its download target is a private IP address that public traffic cannot reach.
Who is behind servicepipe.tech?
The script's domain has a near twin in Russia. The servicepipe.ru site advertises high-precision traffic control systems and cloud or local protection products against DDoS attacks, bots, and targeted threats. That is the profile of a legitimate anti-bot and traffic-filtering vendor, the same market as Cloudflare Turnstile or Akamai's bot manager, both of which the author lists among the usual fingerprinting suspects he has studied.
The company identification comes with a caveat the author states plainly. He credits a contributor named Sshell with tracing the connection, and notes that it rests on the near-identical name and matching product category rather than on confirmed corporate registration records. Service Pipe had made no public statement about the script as of 29 October 2026.
The domain pairing is worth stating carefully. The .tech domain serves the tracking code, while the .ru site describes the vendor's products in Russian. The two share a name and, in the post's screenshots, a related visual identity, but neither site links to the other. This article did not find a corporate registry entry connecting them.
The infrastructure itself remained active when checked for this article on 29 October 2026. The same script path cited in the post returned HTTP 200 with roughly 420 kilobytes of JavaScript, and urlscan.io's history shows the Russian domain serving pages as recently as 12 October 2026. Whatever the script's purpose, it is still deployed and still being served to real visitors.
Does anti-LLM obfuscation actually work?
The evidence cuts both ways. Two assistants refused to help the researcher, which shows the decoys can stall exactly the workflows they target. But GLM-5.3 completed the deobfuscation without fuss, and experienced practitioners in the discussion threads argued that modern agents are harder to fool than the trick assumes.
The story drew more than 1,000 upvotes and over 200 comments on Hacker News within a day, plus a parallel discussion on Lobsters. One reader wrote that agents read the syntax tree and ignore dead code, so alarming names alone accomplish little; in his view a deterrence attempt would need matching behaviour to convince a careful model. A commenter with the handle of a GStreamer maintainer said that project removed a similar marker string because models recognise such text as prompt injection.
Others traced earlier precedents, including anti-AI warnings that developers pasted into personal profiles and project pages. One commenter noted a marker string of that kind had since been removed from where it was posted, which he read as evidence that platforms treat such text as a prompt-injection risk rather than a novelty. Readers also floated darker readings, from deliberate poison bait to cover for real capability, but no evidence emerged for anything beyond obfuscation. The thread's mood was less a verdict than a wager: the contest between automated analysis and automated resistance is young, and each side keeps adapting to the other.
What are the risks, and what happens next?
For site owners the finding raises a branding question first. One commenter argued that customers of such a service have no way to know their domains feed bioweapon-flavoured text to model providers whenever a crawler loads the script. Another replied that models are unlikely to associate obfuscated tracker code with any customer's brand, since the text sits inside minified JavaScript rather than on the visible page.
A subtler risk is accidental prompt injection. If an automated agent scrapes a page, downloads the script, and decodes it inside its own context, the hidden instructions could steer that agent instead of being refused. Security teams that automate script review with LLMs should treat any such content as untrusted data and keep the decoded payload out of the model's instructions, exactly as they would treat a web page carrying injected text.
The ordinary privacy ledger still applies underneath all of it. Fingerprinting lets sites recognise returning visitors without cookies, a practice that sits in a regulatory grey zone in many jurisdictions. The twist documented here does not change what data is collected; it changes how the collection defends itself from inspection.
The researcher says he will keep polling the script for updates and plans diffing views that track changes to fingerprinting payloads and to the web APIs used for fingerprinting. That would turn a one-off find into a monitoring capability for the wider community.
Until then, the practical advice for analysts is procedural. Treat decoded strings from third-party scripts as untrusted input, keep them away from system prompts, and record refusal events as a signal rather than a verdict. A refusal means a script contains tripwires, not that it contains working malware.
The script's continued availability also creates a natural experiment. If the payload changes in the coming days, that suggests the vendor is reacting to the attention, and a diff would show which parts the company considers sensitive.
Three signals will show whether this technique spreads beyond one vendor. Watch whether Service Pipe comments on the finding or quietly removes the script, whether other anti-bot products turn out to be seeding similar decoys, and whether mainstream security vendors add coverage of the technique to their threat reporting. As of 29 October 2026 the report had circulated mainly through researcher blogs and developer forums, and independent lab-style verification of which models refuse the file had not yet appeared.
- •Watch the same servicepipe.tech script path for payload changes.
- •Check fingerprint.garden for new vendors carrying hidden decoy text.
- •Follow the Hacker News and Lobsters threads for further independent analysis.