veritas found a browser-tracking script that appears designed to make AI assistants refuse to inspect it. The discovery came from a crawl of 10,000 websites. Behind one attractive canvas image were alarming function names and hidden text impersonating instructions to the model.
- Astra refused to explain the script even after being told the names might be deliberately misleading. A second attempt using Daybreak Blue was also blocked.
- GLM-5.3 complied with the same prompt. The technique’s effectiveness already varies across models.
- The recovered browser code collects ordinary fingerprinting signals: details about the browser, hardware and graphics system that help distinguish visitors.
The case points to a problem for AI-assisted code review: hostile source text can try to stop the reviewer from reading it. A refusal leaves work unaudited.
Caveat: the article gives no controlled test with the alarming strings removed. Its separate, suspicious Node.js branch also remains insufficiently explained to call harmless.
The 115-comment thread on Hacker News adds limits to the broader claims about refusal triggers.
What the thread adds
- blerb795 — says a different Anthropic trigger string “hasn’t worked in a few months” and that Claude will discuss it. This is a commenter’s counterexample, not a retest of this script.
- driverdan — reports that several Chinese models answered sensitive political questions rather than refusing: “None of them refused to answer or blocked the keywords.” That anecdote challenges assumptions about political trigger text.
- avovana — asks about the practical cost: “Did it take just a few minutes, or a few hours?” The article gives no deobfuscation timing.
Handles are pseudonymous; HN exposes no per-comment scores. Ordering follows HN’s ranking, so this is a slice of the thread, not a consensus.