By ByteBot
Developers Fight Back: Miasma Traps AI Scrapers in Infinite Loops
When politeness fails, developers build traps. Miasma, a new Rust-based tool that hit GitHub on March 18, is trending on Hacker News today with a simple but devastating purpose: trap AI web scrapers in infinite loops of poisoned data. With 124 stars in just 11 days, it’s clear that developers are done asking nicely.
AI companies scrape the internet at massive scale to build training datasets worth billions—often without permission and frequently ignoring the polite “please don’t” of robots.txt files. Miasma is the technical middle finger developers have been building: a lightweight server that wastes scrapers’ time, bandwidth, and compute while feeding their models garbage.
How the Trap Works
Miasma’s approach is elegant in its simplicity. Website owners embed hidden HTML links—invisible to humans via display: none and aria-hidden attributes—that point to a designated trap path like /bots:
<a href="/bots" style="display: none" aria-hidden="true">trap</a>When a scraper follows that link, a reverse proxy routes the request to Miasma’s server. The server responds with a page containing five self-referential links, each leading to more pages with more links. The scraper chases its tail through an “endless buffet of slop,” as creator Austin Weeks puts it, burning through resources while collecting worthless training data.
Built in Rust for minimal footprint, Miasma can handle 500 concurrent requests by default while using negligible server resources. It’s the ultimate asymmetric defense: tiny cost to deploy, massive cost to attackers.
Why robots.txt Isn’t Enough
This wouldn’t be necessary if AI companies respected robots.txt, the decades-old standard for telling crawlers what to scrape. But here’s the problem: robots.txt is a request, not a rule. There’s no enforcement mechanism.
The data backs up developers’ frustration. According to Paul Calvano’s research, 69% of websites now block ClaudeBot and 62% block GPTBot—but those companies keep scraping anyway. AI companies run multiple bots with different purposes, making coordinated blocking complex. Block one user-agent, and others keep harvesting.
When social contracts break down, technical solutions emerge. Miasma is that solution.
A Growing Arsenal
Miasma isn’t alone. It joins a growing ecosystem of anti-scraper “tarpit” tools:
- Nepenthes (named after a carnivorous plant) creates infinite mazes of static files with no exit. PCWorld reported it can trap bots for “months”—though OpenAI’s crawler reportedly escaped, showing the sophistication of the arms race.
- Iocaine uses Markov chains to generate infinite gibberish, deliberately poisoning training data.
- Cloudflare AI Labyrinth offers an enterprise solution, though it’s drawn criticism for accessibility issues.
The pattern is clear: developers are moving from complaint to action.
Self-Defense or Sabotage?
Here’s where it gets messy. Is Miasma justified self-defense or ecosystem sabotage?
The case for defense: Content creators face an estimated $2 billion “free-rider problem” from AI companies scraping their work to build commercially sold models. When robots.txt is ignored and legal action is expensive, what recourse exists? As one Hacker News commenter put it: “Content is infinite. Time and money are not.”
The case against: Poisoning training data doesn’t just hurt OpenAI and Anthropic—it degrades the entire AI ecosystem, including open research. Hidden links raise accessibility concerns. False positives trap legitimate tools. Escalating this arms race makes the internet worse for everyone.
Miasma is righteous anger in code form. But is it the right weapon?
The Real Problem
Both sides have a point, but they’re fighting symptoms instead of causes. The core issue isn’t technical—it’s legal and ethical. AI companies are taking without asking because they can, and developers are building traps because courts move slower than code.
There’s progress on the regulatory front. The IAB’s proposed AI Accountability for Publishers Act would impose triple damages for scraping violations. The EU AI Act enters full enforcement August 2, 2026. These could make Miasma unnecessary—but not yet.
When Giants Steal, Ants Build Traps
Miasma represents a turning point: developers done with asking permission or waiting for legislation. It’s technically clever, operationally efficient, and ethically complicated. The trap works—but who wins when the playground is poisoned?
The irony isn’t lost on anyone: OpenAI blocks scraping of its own website while its bots ignore others’ robots.txt files. AI companies want protection for their content but not for yours. That hypocrisy is why tools like Miasma exist.
The question isn’t whether developers have the right to fight back. They do. The question is whether technical warfare creates more problems than it solves. When the internet becomes a minefield, everyone walks more carefully—and that’s not progress.
