Open-Source Tool Anubis Fights Back Against AI Scrapers

With over 200,000 downloads and adoption by global institutions, Xe Iaso’s Anubis is quietly waging war on AI-powered web scrapers—without breaking the internet for everyone else.

The Birth of Anubis

In January 2025, developer Xe Iaso released Anubis, an open-source tool built to thwart AI scrapers. Since then, the project has seen rapid uptake, racking up nearly 200,000 downloads and gaining traction among notable organizations including UNESCO, as well as developers behind GNOME and FFmpeg.

But Anubis wasn’t born out of theory or curiosity—it was born out of necessity.

“I couldn’t even load the [server page] in my browser, which seemed odd,” Iaso told 404 Media. “When I checked the logs, I saw it had restarted about 500 times in two days. Digging deeper, I found an Amazon bot clicking on every single link.”

Faced with a Git server under siege and unable to simply take it offline—some of her projects needed to remain public—Iaso took a different path.

“I tried a few things I can’t discuss on the record. Nothing worked. So I had a bad idea,” she said. “I wrote some code, tossed it on GitHub as an experiment, and suddenly GNOME developers started using it as a last resort. That’s when I knew I’d struck gold.”

Why Traditional Defenses Don’t Cut It

Anubis arrived at a moment when existing defenses were starting to feel useless.

• robots.txt is widely ignored by AI crawlers.
• CAPTCHAs—once the gold standard—are increasingly bypassed using automated solvers or human farms.
• Rate limits are trivial to work around with rotating IPs and distributed scraping infrastructure.

In the vacuum left by these failing defenses, a cottage industry of countermeasures has emerged:

• Nepenthes: A “malicious” trap that strands crawlers in a maze of static files.
• Cloudflare’s AI Labyrinth: A corporate-grade honeypot that serves fake content to unauthorized scrapers.
• Cloudflare's latest move: Blocking AI scrapers by default—even for users on the free tier.

But Iaso remains skeptical of certain tactics, especially data poisoning—polluting training datasets with garbage to render models less effective.

“It makes you feel better, but you’re burning more compute than you save. To put it politely: If you pee in the ocean, the ocean won’t turn into pee.”

How Anubis Actually Works

Unlike traditional CAPTCHAs, Anubis doesn’t present the user with puzzles, checkboxes, or image grids. It’s what Iaso calls an “uncaptcha”—a system that verifies human users invisibly and passively.

It works by:

• Running cryptographic computations in the browser via JavaScript, proving it’s a real user environment.
• Performing hidden behavioral checks that bots typically don’t know how to mimic.
• Keeping the user experience seamless—invisible for people, but expensive for bots trying to scrape en masse.

In short, it’s a clever inversion of the usual problem: humans don’t have to prove themselves, but bots must work unusually hard to pretend.

What’s Next for Anubis?

Despite its success, Anubis is far from done. Iaso is actively working on updates to make the tool more accessible and less resource-intensive.

Planned improvements include:

• A cryptography-free version to reduce CPU load for less powerful devices.
• A JavaScript-free mode to support users with strict privacy settings or accessibility concerns.

But she’s quick to acknowledge the difficulty of the mission.

“We need to block bots without blocking people, avoid false positives, and keep detection methods secret from bot operators—while still letting real users understand why they might get flagged. A typical impossible task.”

That balance—between protection and accessibility—is the tightrope every modern developer is forced to walk.

A Message for AI Scraper Teams

It’s clear Iaso knows her work is being watched. She suspects AI firms are tracking Anubis closely, perhaps even looking for ways around it.

Her message to them?

“If you want to stop me, here’s the best way: First, quit your job. Second, join Square Enix. Third, make mind-blowing content for Final Fantasy XIV. That’s what would really work.”

It’s a tongue-in-cheek comment—but the sentiment is real. Fight fire with creativity, not exploitation.

Final Takeaways

Anubis uses invisible browser-based checks to stop AI scrapers—no puzzles, no friction.
200K+ downloads and used by high-profile organizations like UNESCO, GNOME, and FFmpeg.
More resilient than CAPTCHAs: lightweight for humans, costly for bots.
Actively maintained, with future versions aimed at reducing CPU and JS dependency.
Iaso’s guiding principle: Keep the internet usable for people—not just machines.

“The internet shouldn’t belong to bots.” — Xe Iaso