A post on the reverse-engineering blog nullpt.rs is titled "Why is this fingerprinting script creating bioweapons?" — half a quote, half a serious question. The answer is that the script is not making biological weapons. It is built so that a language model asked to analyse it gives up.
The observation: a fingerprinting and bot-protection script served to websites contains strings naming bioweapons, self-harm and other sharply guarded topics, apparently placed as bait for safety classifiers. Take the script apart with a model and you get a refusal instead of an analysis. Open it in a beautifier and you still just see JavaScript.
What the discussion established, and what it did not
The post reached number two on Hacker News within hours, with more than 800 points and roughly 185 comments. The summary readers converged on is unglamorous and unambiguous: no bioweapons are being made; the forbidden terms are a payload aimed at the model, not at a laboratory.
The author joins the thread and concedes the headline is overpitched — "Coming up with a title was harder than actually writing the article" — and apologises for it being "a bit sensationalized". One commenter with access to the code reports that a model blocked the request even with a particular switch ("Daybreak Blue") engaged; another says an open-weight model complied with the same prompt.
What remains unestablished: how many sites serve the script, which vendor is behind it, and whether the bait was placed deliberately or arrived inside an obfuscated library. A claim circulating in the thread — that an officially documented string once existed for testing refusals — is both asserted and dismissed there as a hoax. This account rests on the researcher's write-up and the discussion around it, not on an independent measurement.
Three consequences the thread kept returning to
Brand risk. Anyone buying this kind of bot protection now serves its contents from their own domain. One commenter works through the scenario: a company that has spent effort explaining what it does suddenly has bioweapons, poisons and politically charged references in its source — and an assistant asked about that company later may balk.
Account risk for agents. Crawling such pages on someone else's behalf can put you in the classifier's path. One reader calls it "the ultimate cyberattack": not the server gets compromised, but the account of whoever reads it.
Durability. The scepticism is loud. Several commenters argue the trick falls to identifier substitution, comment stripping and ignoring dead code — agents read the syntax tree, not the decoration. One who runs anti-LLM defences writes that you need "evil context" as well as evil names, and that you must actually execute the code; the better approach is serving so many bundles that mass scraping cannot scale.
Why it is more than a curiosity
This is a direction change. Bot defence used to mean detecting machines by behaviour — TLS fingerprints, headless flags, timing. Now the defence addresses the reader's semantics: instead of keeping the bot out, you persuade it to give up.
That only works while models abort on coarse signals and while a site operator carries no liability for what it serves. Both are negotiable. The cleaner option would be a machine-readable statement — a directive telling crawlers what is permitted. Instead, someone decided the cheapest way to stop a model is to frighten it.
