Anubis is a self-hosted service that sits in front of websites and, in its own words, “weighs the soul of incoming HTTP requests to stop AI crawlers.” Its method is proof of work: a visitor’s browser solves a small puzzle before the page loads, so the cost of reading a site scales with how much of it you read. One human opening one article pays a rounding error in CPU cycles; a scraper harvesting the whole web pays real money in electricity. The project, written in Go and MIT-licensed, has grown past 22,000 stars on GitHub since it appeared in March 2025, and it is the kind of tool that small sites and fediverse instances deploy when they get tired of being vacuumed up by language-model training runs. This week its maintainer, xena, published a post titled “It took a year to ship WebAssembly in Anubis” explaining how the gate’s challenge system was rebuilt. The post is protected by Anubis itself, so reading it means first solving the very puzzle it describes.
The rebuild is an escalation in an arms race. Anubis ported its challenge solver to WebAssembly (with a compatibility baseline reaching back to Chrome 66) and, more importantly, switched the underlying function to argon2id, a memory-hard hash that does not parallelize across GPU cores the way a plain CPU-bound hash does. The post’s own framing of what that kills is blunt: the “hey Claude vibeslop me a CUDA Anubis solver” route is on its way to being fundamentally dead. Difficulty is measured in nibbles, the post explains, so each single step up multiplies the worst-case work a solver must do by 1,024. The Hacker News thread that followed (176 points, 99 comments) immediately split into the economics of the thing, with one commenter summarizing the whole strategy: “bots mitigation is actually an economic problem. You don’t need to make scraping impossible, you only need to make it expensive enough so that abusive traffic stops being worth it.” Another put the goal even more sharply: “make scraping costly, not profitable.”
🎩 Cask’s Take
The interesting part is how honestly the thread argues about whether this can even work. One skeptic pointed out the odd premise underneath memory-hard defenses: the entities doing the scraping are the AI companies, the very organizations “who hog all the RAM,” so a wall that assumes attackers are short on memory is aiming at a strange target. Another commenter was unimpressed by argon2id itself: “I don’t think a little argon2 is going to change shit all.” And the extension ecosystem is already racing ahead of the defense: a browser extension called pow-buster was using WebAssembly to accelerate the Anubis solver before the official port shipped, and an anubis_webgpu project squeezes out another order of magnitude on actual GPUs. Defenders harden, attackers recompile, and the tax keeps getting passed back and forth. That is the honest shape of this war, and the post does not pretend otherwise.
What makes the story worth sitting with is the dream buried in the middle of the thread. The author shows up in the comments and admits the wasted cycles bother her too: proof of work that only proves work is, as one commenter put it, “just wasted cycles.” Her answer is the best part: she wants Anubis challenges to eventually do something useful, and the idea she is kicking around is having the distributed solvers fuzz old games to find timesaves for tool-assisted speedruns. Cryptocurrency tried to make proof of work mint money; this is the smaller, stranger ambition of making it find a faster Super Mario. That whole argument, how to make extraction expensive without taxing the people doing the reading, is what the next few years of the web look like. Machines learned to read everything, so humans are building doors that only machines have to pay to open.