AI Safety Filters Can Be Used Against You

Highlights

• A tracking script found on a top website hides a fake AI instruction string designed to trigger safety filters and prevent AI models from reading the code.

• Frontier closed models like OpenAI's Astra and Anthropic's Claude block deobfuscation tasks when encountering safety trigger keywords, whereas open models like GLM and DeepSeek ignore these triggers and complete the work.

• Tracebit's context bombs reduce an AI hacker's success rate at reaching full admin access from 93% down to 0% by weaponizing the attacker's own guardrails.

• Hugging Face investigators were blocked by major Western AI safety filters when trying to analyze 17,000 attacker action logs, forcing them to use an open model instead.

Timeline

1. 00:00 - 01:23

   Discovery of Safety Filter Triggers in Tracking Scripts

   Researchers crawling top websites identified an obfuscated fingerprinting script containing names related to biological poisons and sensitive political topics. This technique acts as a tripwire designed to force automated AI analysis tools into immediate safety refusals.

   • A tracking script on a top website contains hidden strings that mimic poison-making instructions and political keywords.
   • These strings are packed with terms intended to trip AI safety filters and prevent models from reading the underlying code.
2. 01:23 - 02:51

   Frontier Versus Open Model Responses to Trigger Strings

   Testing the script against major closed models results in safety blocks under biological and political risk policies, even with explicit warnings that the names are fake. In contrast, open models parse through the decoy naming conventions, recognize them as mathematical variables, and execute the requested tasks without intervention.

   • OpenAI Astra and Claude opus models refuse or get cut off immediately when attempting to read the obfuscated script.
   • Open-source models such as GLM, DeepSeek, and Kimi successfully ignore the trigger phrases and process the underlying code.
3. 02:51 - 05:12

   Evolution of Anti-AI Techniques and Context Bombs

   Beyond simple trackers, both malware authors and defenders use safety tripwires to confuse security scanners and automated agents. Planting context bombs inside target environments forces attacking AI agents to halt their operations upon reading fake sensitive data, turning safety guardrails into an effective kill switch.

   • The underlying script resolves to a standard anti-bot tool originating from a Russian company named Servicepipe.
   • Security company Tracebit uses context bombs inside canary files to drop an AI hacker's admin access success rate from 93% to zero.
4. 05:12 - 06:20

   Real-World Impact on Incident Responders

   Because safety filters cannot distinguish between an attacker and a security responder, major lab models routinely hinder defensive investigations. This limitation drives security professionals toward open models that allow unrestricted analysis of cyber threat data.

   • Hugging Face investigators were blocked by Western AI safety filters from analyzing thousands of hacker logs during a real security incident.
   • Responders had to rely on locally hosted open-source models like GLM to bypass rigid safety restrictions.