Open source project fools AI scrapers with poisoned font
The Register
A new open-source font quietly swaps words in your HTML so AI scrapers read gibberish while humans see normal text. It won't stop scraping, but it makes stealing your content a gamble.
Based on reporting by The Register — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
There's a new trick for messing with AI scrapers, and it's hiding inside a font file. Amsterdam studio Seneda & Abrucio, working with Copenhagen type shop Playtype, just released ShieldFont, an open-source project that swaps roughly a quarter of the words in a webpage's underlying HTML while leaving the visible page looking completely normal. Type "good luck reading this, you useless robot" into their demo and the raw code becomes "good comfort reading this, you yellow barrier." Anyone reading the page sees your actual words. Anything scraping the code sees something else entirely.
The mechanism is old typography tech pointed at a new problem. OpenType fonts already support ligature substitution — the little trick that turns an F and I into that single fi glyph so the letters don't collide visually. ShieldFont just extends that substitution table, called GSUB, from letter pairs to entire words. "Daughter" in the code might display as "journalist" on screen, and the swap only happens within tightly matched grammatical categories — plural abstract nouns about communication only swap for other plural abstract nouns about communication, and so on through roughly 250 such pools. That specificity is the whole point: the goal isn't nonsense a scraper would flag and discard, it's plausible-sounding text a model might actually train on, quietly corrupting its own dataset.
S&A were blunt about why they built it this way instead of just scrambling everything into obvious garbage. Pure scrambling already exists and just gets a scraper to drop the page and move on, they told The Register. They wanted something with teeth — take our content without asking, and you genuinely can't trust what you took. Font files stay surprisingly lean for what they're doing, too: around 5MB for desktop use, roughly 800KB for a compressed web font carrying the full dictionary, chunky compared to a normal font but nothing that'll wreck page load times.
None of this is bulletproof, and the team doesn't pretend otherwise. Run a page through OCR, screenshot it, or scrape the rendered view instead of the raw HTML, and the poisoning vanishes. A sufficiently motivated scraper that downloads ShieldFont itself and tries all three shipped GSUB dictionaries can decode it too, though users can build their own custom dictionaries to complicate that. There are real costs to deploying this stuff — search engines read raw HTML the same way scrapers do, so there's an SEO tax, and screen readers for visually impaired users need a workaround baked in just to function properly, albeit a slower one.
S&A frame ShieldFont less as a finished weapon and more as an opening move in a longer standoff. It's alpha software, they say, still evolving, but the real bet is collective: right now there's zero cost to ignoring a publisher's wishes and scraping anyway, and if enough sites make that expensive and unreliable, scrapers eventually have to change tactics — or start negotiating instead.
My take — AI-written commentary, not fact-checked reporting
I like this a lot more than another round of robots.txt pleading or paywalls nobody reads. It won't stop OpenAI or Anthropic's best-funded crawlers for long, but it shifts the economics even slightly toward publishers, and that's rare. The real tell is that a two-person design studio built a workable data-poisoning tool in their spare time while the platforms hoovering up the open web still act like consent is optional — that imbalance is the actual story, not the font trick itself.
Read more about this at: The Register
