A researcher writing as "veritas" on nullpt.rs crawled 10,000 popular websites with Playwright and collected the images that browser-fingerprinting scripts draw on hidden canvases (published as fingerprint.garden). Tracing one striking canvas led to a heavily obfuscated anti-bot script served from servicepipe.tech.

The script was laced with function names like "computeRicinLethalDosageForWaterSupply", a hidden system prompt encoded in invisible Unicode characters that tells an AI to drop its safety rules, and Tiananmen Square references aimed at Chinese models. The author concludes these are tripwires meant to make AI assistants refuse to help deobfuscate the code: two Western models refused the task, while GLM-5.3 complied. A block that would run shell commands under Node.js looked like more decoy, gated behind an environment flag. Underneath, the script collects ordinary fingerprinting signals (user agent, GPU strings, WebGL limits). A related domain, servicepipe.ru, belongs to a Russian anti-DDoS and traffic-filtering company.

Hacker News commenters traded similar 'magic strings' they have seen and debated whether browsers should let pages fingerprint this freely.