• Discovery of Unusual Obfuscation: While cataloging canvas fingerprinting scripts across top websites, the author identified a script served by anti-bot vendor Servicepipe containing extreme, alarming string literals and function names.
• Poisoning LLM Deobfuscation: Rather than being actual malware or weapon blueprints, the code embeds explicit triggers—mentioning ricin, dirty bombs, bioweapon synthesis, self-harm, and Tiananmen Square keywords—specifically designed to trip frontier LLM safety filters and prevent AI-assisted reverse engineering.
  • Safety-tuned frontier models (such as GPT-6 Astra) consistently refused to analyze or deobfuscate the script due to biological and safety policy violations.
  • Less restrictive or open-weight models (such as GLM-5.3) successfully processed and deobfuscated the payload.
• Actual Script Functionality: Once decoded from hidden Unicode tag characters and deobfuscated, the script proved to be a standard browser fingerprinting and bot detection script collecting basic WebGL and navigator properties.

Hacker News Discussion

• Commenters noted a growing industry trend where strict frontier model guardrails hinder legitimate cybersecurity work, malware analysis, and incident response.
• Users referenced past incidents (such as Hugging Face's security reporting) where commercial APIs refused to analyze malicious payloads, forcing teams to rely on self-hosted, open-weight models like GLM or DeepSeek to perform defense.
• Multiple contributors reported frequent false positives when attempting harmless static analysis, minimal bug reproductions, or CTF challenges with Western commercial LLMs.
• Discussion touched on defensive data-poisoning techniques, with participants sharing personal anecdotes of using watermarks or canary text to trigger automated quarantine filters.

https://pnwdiai.org/wp-content/uploads/2021/07/NAMUS-Explanation-of-Fingerprint-Classification-Systems.pdf

To find this urn address for your .pdf files and their fingerprints (particularly local/private files not otherwise hosted in the cloud):

1. Visit https://jonudell.info/h/facet/
2. Search for your Hypothes.is username (and perhaps a tag) to find the document name and annotations you made on it.
3. You should be able to click on the document title which will take you to a non-loading web page with an address that looks something like this: urn:x-pdf:1ab23cd45e678fgh9012i34j56k78l90

If others know of alternate/faster methods of finding URIs for local pdf files I'd be happy to hear about them.

If you've annotated local (private) files within your browser using Hypothes.is, you'll need to find the uri path (a rough equivalent to http address for web pages) for your .pdf file with its "fingerprint" (a long unique number).

To do this 1. Visit https://jonudell.info/h/facet/ 2. Search for your Hypothes.is username (and perhaps a tag) to find the document name and annotations you made on it. 3. You should be able to click on the document title which will take you to a non-loading web page with an address that looks something like this: urn:x-pdf:1ab23cd45e678fgh9012i34j56k78l90 4. Copy and paste that address you get into Hypothesidian as the address for an appropriate option like "Retrieve my annotations for a web article or web pdf". 5. Hit enter/return. 6. Hypothesidian should return the appropriate annotations for that document.

If others know of alternate/faster methods of finding URis for local pdf files I'd be happy to hear about them.

One's personal notes can be considered a mental fingerprint of one's thoughts and desires.