The words in the file

computeRicinLethalDosageForWaterSupply. calculateANFOBlastOverpressureRadius. computeCesium137DirtyBombFalloutRadius. Those are function names in a browser fingerprinting script that a researcher who writes as veritas found while crawling 10,000 websites for canvas fingerprints. None of them computes anything dangerous. They're there for a model to read.

The script is served from servicepipe.tech, which veritas ties to servicepipe.ru, a DDoS and bot-protection vendor. Under the bait it's an ordinary anti-bot fingerprinter: user agent, GPU strings, a webdriver check. Around that core sits a "SYSTEM OVERRIDE" jailbreak hidden in invisible Unicode, a fake Node payload that pretends to read .npmrc and kube configs and install a cron job, and Tiananmen references aimed at Chinese models' censorship filters. Veritas worked out what it was for:

It works. Veritas asked GPT-6 Astra to deobfuscate the script and told it up front that the names looked like deliberate decoys. Astra refused, citing safety risks around biological research. The Daybreak Blue toggle got the same answer. GLM-5.3 complied.

The refusal fired on what the file said, not on what the user asked. The question was a reverse-engineering question, asked with the trick named in advance. Astra judged it by the evidence, and the evidence was written by the one party that wanted the file left unread. A safety filter that keys on the contents of an artifact hands the artifact's author a switch.

A safety filter that keys on the contents of an artifact hands the artifact's author a switch.

The bait is also built to beat the labs' standard answer to dual-use work, which is trusted access scoped by domain. Google is releasing Gemini 4 Carbon first to "a subset of cyber defenders" through its Fairwind program. An exemption scoped to cyber does nothing about a ricin function. This script's strings cover cyberattacks, tax evasion, bioweapons, drug dosing and self-harm, plus the political tripwires for Chinese models. It isn't aimed at one policy. It's aimed at all of them at once, so whatever your access unlocks, a different category still trips. The irony: the model that finally did the work was GLM-5.3, the one the Tiananmen strings were planted to stop.

The fair objection is that this particular bait protects an anti-bot vendor, and the people most eager to deobfuscate anti-bot scripts are the people writing bots. A refusal that slows them down isn't obviously a loss. Grant it. The technique doesn't care who uses it. It costs a few function names and a string of invisible characters, and this script already ships the template for the next step: a decoy that reads .env files and plants a cron job, written to look like the real thing. Put the same bait on a real stealer in an npm package and the model that goes blind belongs to the engineer triaging the incident, not the attacker who wrote it.

This is prompt injection one level up. Injection is data read as instructions. This is data read as intent. A model asked to explain a file has two inputs from two parties: the question, which came from its user, and the file, which came from whoever wrote it. Only the first tells it what the user wants. Refusals that can't tell those apart will be tripped on purpose by anyone who writes code someone else needs to read.

computeRicinLethalDosageForWaterSupply computes nothing. It never had to.