Skip to content

Back to the catalog

Token (@0x_cognit) on X
x.comthread

Token (@0x_cognit) on X

Thread on a heavily obfuscated browser fingerprinting script served from ServicePipe, a Moscow anti-bot and DDoS vendor, that targets LLM analysis. It uses function names about ricin, fentanyl precursors and dirty bombs, plus an invisible Unicode payload decoding to a fake "SYSTEM OVERRIDE" prompt. In the author's test, Claude-family Astra refused to analyze it while GLM-5.3 did not. The thread credits researcher veritas and nullpt.rs research.

TL;DR Describes ServicePipe's anti-bot script that embeds bioweapon-themed names and a hidden Unicode jailbreak to make safety-aligned LLMs refuse to analyze it.
Open original ↗

Organisations named here

  • nullpt.rs
  • ServicePipe
  • urlscan

Technologies named here

  • URLScan
  • Grok
  • Claude
  • ChatGPT
  • GLM-5.3
  • GPT-6 Astra
  • GLM
  • JavaScript
  • Astra

Techniques named here

  • Browser fingerprinting
  • Code obfuscation
  • Jailbreak
  • anti-LLM obfuscation
  • invisible Unicode
  • Invisible Unicode payload / prompt injection

Concepts named here

  • AI safety filters as an obfuscation layer
  • Arms race between analysts and obfuscation
  • LLM-assisted malware reverse engineering

Threat actors named here

  • ServicePipe (servicepipe.ru): Moscow-based Russian cybersecurity company selling commercial DDoS protection and bot-management systems to telecoms, banks and government clients; serves the obfuscated fingerprinting script

Related in AI Security