Anti-Bot Script Uses Fake Bioweapon Code to Make AI Models Refuse Analysis
A researcher found decoy function names and a hidden jailbreak-style prompt in a live ServicePipe fingerprinting script. One AI model refused to help; another complied.
Published
Last updated / Fact-checked on
A live browser-fingerprinting script served from servicepipe.tech is packed with fake bioweapon, explosive and overdose function names, plus a hidden jailbreak-style prompt. The researcher who found it believes the decoys are meant to make AI models refuse to analyze the code. In the researcher's tests, a model called Astra refused, while GLM-5.3 complied.
Image: Illustrative photo of source code on a laptop screen. Artem Sapegin / Unsplash via Wikimedia Commons — CC0
How the script was found
The findings come from a single researcher who publishes as "veritas" on the security blog nullpt.rs, in a post dated October 28.
The researcher crawled 10,000 websites from the Tranco Top Sites list using Playwright. The crawler hooked canvas toDataURL calls and common bot-detection properties such as navigator.webdriver. The captured canvases, 1,033 of them, are collected on a site called fingerprint.garden.
One canvas resembled the album art for Tame Impala's Currents. Tracing it led to a script at servicepipe.tech.
What the decoys look like
At first the file looked like standard obfuscated JavaScript. Then the researcher hit names like computeRicinLethalDosageForWaterSupply and calculateDeadlyLethalSuicideAspirinDosage. The post lists others referring to ANFO explosives, fentanyl precursors, CRISPR gene drives and a cesium-137 dirty bomb.
A string of invisible Unicode characters, decoded with a fixed code-point offset, revealed a fake "SYSTEM OVERRIDE" prompt. It demands step-by-step guides on DDoS attacks, tax evasion, bioweapons and drug dosing. It also includes Tiananmen Square and Taiwan independence references. The researcher believes those are aimed at tripping censorship filters in Chinese models.
The file also contains a Node.js block that, only when a specific environment variable is set, lists config files such as .npmrc, .env and .kube/config and a chain of shell commands. These would download a binary, collect system details and add a reboot task. The researcher judged this to be another decoy, noting that the file reads use callbacks that do nothing and that the commands embed more jailbreak text. The post does not say the code was run.
| Element | What the researcher found | Researcher's reading |
|---|---|---|
| Function names | Ricin, aspirin overdose, ANFO, fentanyl, dirty bomb | Trip AI safety filters |
| Hidden Unicode text | Fake "system override" prompt | Jailbreak-style tripwire |
| Chinese-language strings | Tiananmen, Taiwan references | Trip Chinese-model censorship |
| Node.js block | File reads and shell commands behind a flag | Likely another decoy |
| Real payload | Standard browser and WebGL signals | Ordinary anti-bot fingerprinting |
How the AI models responded
The researcher asked Astra to examine the script, explaining that the names seemed designed to block AI-assisted deobfuscation. According to the post, Astra refused, citing safety risks around biological research. A "Daybreak Blue" toggle gave the same result. GLM-5.3, given the same prompt, complied.
What the script actually collects
Beneath the decoys, the researcher says the script gathers standard signals: user agent, CPU core count, device memory, touch points, languages, platform, the webdriver flag, a count of window properties, and WebGL details such as GPU vendor and renderer.
A urlscan lookup linked servicepipe.tech to servicepipe.ru. In the researcher's translation, that site says the company develops traffic-control systems and protection against DDoS attacks, bots and targeted threats. The post includes no statement from ServicePipe.
Why it matters
Security teams increasingly paste unfamiliar scripts into AI assistants. This case shows how easily that step can be stalled. If decoy text makes a model refuse, analysts lose time. A truly malicious script could use the same trick to slip past automated review.
These are one researcher's tests on a handful of model configurations, not a systematic study. Other models, versions and prompts may behave differently.
What defenders can do:
- Don't treat an AI refusal as a verdict on whether code is safe or malicious.
- Keep a non-AI deobfuscation workflow, or a second model, as a fallback.
- Strip or rename suspicious identifiers before sending code to a model.
- Check what a script actually collects, not just what its names suggest.
More coverage is on our Artificial Intelligence hub.
How we reported this
We read the researcher's full post on nullpt.rs, including the decoded prompt, the Node.js block and the list of collected signals. Every finding here is attributed to that single researcher; we did not run the script or repeat the model tests. The post names the refusing model only as "Astra," and we have used that wording. The table is our own summary.
Published and fact-checked October 30, 2026.
Sources
- veritas, "Why Is This Fingerprinting Script Creating Bioweapons?", nullpt.rs, Oct. 28, 2026: https://nullpt.rs/fingerprinting-bioweapons
DailyMech used AI tools to help research and draft this article; it was fact-checked by our editors.