AI Tar Pits Are Drowning LLM Scrapers in Infinite Garbage

How tools like Nepenthes, Iocaine, and Cloudflare’s AI Labyrinth trap unauthorized crawlers in endless mazes of generated nonsense and poison the training set on the way out.

TL;DR: An AI tar pit traps an unauthorized LLM scraper in an endless loop of machine-generated junk. It burns the crawler’s compute and feeds poison into the training set on the way out. Nepenthes started it. Iocaine sharpened the poison. Cloudflare shipped AI Labyrinth to the whole internet on a single toggle. The crawler can’t tell the maze from the real site, so it walks in and never comes back.

What Is an AI Tar Pit?

Block a scraper and you tip your hand. The operator sees the 403, shrugs, rotates the IP, swaps the user-agent, and comes back through a residential proxy an hour later. You taught them you’re worth evading.

So the tar pit does the opposite. It says yes to everything.

An AI tar pit serves an unauthorized crawler an endless tree of generated pages instead of blocking it. Every page is stuffed with links that loop back into the maze. Every page loads slow enough to waste real wall-clock time but stays cheap enough that your own server doesn’t fall over. The bot thinks it struck a vein. It’s chewing on nothing.

The name comes from Nepenthes, the carnivorous pitcher plant. You slip in, you slide down, you don’t climb back out. Aaron B. shipped the original in early 2025 and called it exactly what it is: deliberately malicious software. Point any crawler at it and the thing drowns in randomly generated pages, each one packed with fresh URLs to follow.

Here’s the part that makes it nasty. The bot has no exit condition. A human hits four pages of word salad and closes the tab. A scraper doesn’t have taste. It just queues the next URL.

How the Crawler Falls In

The trap works because the scraper can’t tell a real link from bait. Modern LLM crawlers run on one dumb assumption: a link is a link, content is content, grab all of it. They don’t judge whether a page means anything before fetching it. They walk the graph and tokenize whatever comes back.

Nepenthes weaponizes that exact reflex. It generates an endless sequence of pages, each with dozens of links that just go back into the pit. And the pages are random, but random in a deterministic way, so they look like flat static files that never change.

Determinism is the whole trick. If the same URL spat back different garbage every visit, a smart crawler could flag it as dynamic and bail. So the pit fakes the one signal scrapers trust most: stability. Same URL, same nonsense, every time. Looks like a real archive that’s been sitting there for years.

This is the same failure we picked apart in MCP tool poisoning in the wild: the machine trusts a signal it has no business trusting, and the attacker just has to match the pattern. The crawler trusts stability. The pit serves stability. Game over.

Then there’s the stall. An intentional delay drips each response out slow, so the bot sits there waiting on a page that was never going anywhere. Multiply that by a crawl queue that never empties:

GET /maze/a8f3/index.html         200   1.4s   38 links
GET /maze/a8f3/c19b.html          200   1.5s   41 links
GET /maze/a8f3/c19b/77de.html     200   1.4s   39 links
GET /maze/a8f3/c19b/77de/...      200   1.6s   40 links
  [depth: 4]   [pages queued: 6,212]   [real data: 0]   [exit: none]

Six thousand pages deep and the crawler still thinks it’s making progress. The link count never drops to zero, so the work queue never empties. It’s a machine sprinting on a treadmill it can’t see.

Poisoning the Model on the Way Out

Burning compute is annoying. The second payload is the one the AI shops actually fear.

Most tar pits ship an optional Markov-chain generator: a text engine that stitches real words into grammatically plausible sentences with zero meaning behind them. It reads almost right. Real vocabulary, real sentence shapes, nothing true anywhere in it. That’s the perfect poison, because a naive quality filter waves it straight through. It passes the “is this English” check and fails the “is this true” check that nobody’s running at scale.

Iocaine, the follow-on tool named after the poison from The Princess Bride, leans all the way in. Gergely Nagy built it after crawlers chewed through his bandwidth, and his fix was to serve them a plate of garbage designed to slowly rot the datasets they feed.

So why does this land? Because model collapse is a real, documented failure mode, not a revenge fantasy. Train a model on enough of its own slop, or enough synthetic noise dressed up as human text, and the tails of the distribution rot out. Rare cases vanish first. The model narrows, quietly, while the dashboards still say it’s fine. We ran the math on that in AI model collapse makes hallucination inevitable. Tar pits are trying to force on purpose what the open web is already doing by accident.

One thing the operators are honest about: no corpus ships with the tool. You bring your own text. That’s deliberate, and it does two jobs at once:

• Every install looks different. No shared corpus means no shared fingerprint. A crawler can’t learn one signature and route around all of them.

• Everybody’s poison tastes a little different. Which is exactly the point. The defender’s job is to stay un-patternable, and a bring-your-own-corpus design bakes that in.

Cloudflare Turned It Into a Product

Cloudflare took the rebel tooling, gave it a corporate paint job, and shipped it as AI Labyrinth on a single dashboard toggle, free plan included. When it flags improper bot activity, it auto-deploys a network of linked AI-generated pages. No custom rules. Same core idea as Nepenthes, running at internet scale.

Then they bolted on the thing the indie tools didn’t have: a sensor.

No real human clicks four links deep into a maze of AI nonsense. So anything that does is almost certainly a bot. The decoy links are hidden behind nofollow tags a human browser never renders, so the only thing that walks in is something crawling the raw graph. Walk the maze, get tagged, get added to the shared bad-actor list every other Cloudflare customer pulls from. The trap doubles as a fingerprinting rig.

That’s the same cheap detection signal we keep flagging in the free tooling that catches AI-generated junk: did the machine do something no human would ever bother to do?

# the shape of the trap, not the trap
labyrinth:
  trigger: suspected_ai_crawler
  inject: nofollow_decoy_links      # human browsers never render these
  serve: generated_decoy_pages
  on_traversal:
    confidence: high_bot
    action: fingerprint_and_share   # feeds the global block list

And in 2026 the sensor is where the real fight moved. Cloudflare now sorts AI traffic into three buckets, Search, Agent, and Training, and starting September 15 it blocks Training and Agent bots by default on any page that shows ads. The maze isn’t the endgame anymore. It’s the tripwire that decides who gets blocked, who gets throttled, and who has to pay to crawl.

Where the Arms Race Goes Next

Right now the tar pits win on one assumption: crawlers are greedy and dumb. That edge has a shelf life.

The generated mazes still don’t perfectly match a real site’s structure or branding. A crawler trained to spot that seam can learn to route around them, and the big operators already have. OpenAI’s crawler reportedly walked out of the original Nepenthes pit. Cloudflare knows the tell exists too, and has said it wants future labyrinth pages to mirror the host site’s real layout so the seam disappears entirely.

That’s the whole arms race in one sentence. The defender makes the fake indistinguishable from the real. The scraper learns the tell. The defender patches the tell. Round and round, same cat-and-mouse as every other corner of this space.

The tar pit doesn’t have to win forever. It just has to make scraping expensive enough, today, that somebody else’s site is the cheaper meal.

Up next: steps you can take right now and a field-ready security prompt. Thanks for rolling with ToxSec. Let’s get operational.

How to Deploy an AI Tar Pit Without Nuking Your SEO

1. Reach for Cloudflare’s AI Labyrinth before the raw indie tools. It scopes the maze to suspected bots only and keeps it off the pages real users and search engines see. Nepenthes makes no distinction between an LLM scraper and Googlebot, so a careless install drops you from search results. Start with the managed option, learn the behavior, then decide if you need more teeth.

2. Never run a raw tar pit on your production domain. If you deploy Nepenthes or Iocaine directly, cage it. Put it on a subdomain or a path that legitimate crawlers are steered away from, and pair it with a robots.txt that tells honest bots to stay out. The trap is for the crawlers that already ignore robots.txt. Everyone else should never see the door.

3. Watch your own CPU and bandwidth, not just theirs. A tar pit feeds crawlers exactly what they hunt, so it pulls constant bot traffic and spikes server load. On a weak box or a metered connection, you’re paying to poison them. Set the response delays as high as you can tolerate and cap the babble size so the trap doesn’t cost you more than it costs them.

4. Keep the poison corpus yours and keep it weird. The bring-your-own-text design is a feature, so use it. A unique corpus is harder to fingerprint and harder to filter out at the training layer. Don’t grab a public Markov corpus everyone else is running, or you inherit everyone else’s detectable signature.

5. Treat the maze as a sensor, not a wall. The highest-value output isn’t the wasted compute, it’s the fingerprint. Log which user-agents and IPs traverse the decoy links, because anything that walks four pages deep just outed itself as a bot. Feed that list into your real blocking layer at the edge.

6. Assume the seam gets patched. Today’s mazes win because they’re dumb and greedy on the other side. That won’t last. Don’t build a permanent defense on a temporary edge. The goal is to make scraping your site the expensive option right now, not to win the arms race forever.

The Tarpit Detection Rule to Steal

# edge rule: flag and fingerprint crawlers that walk the decoy maze
# redacted values are placeholders — wire to your own log pipeline
rule: ai_tarpit_sensor
match:
  path_prefix: "/<decoy_maze_root>/"      # the caged tar pit path
  link_type: nofollow                      # humans never render these
signal:
  depth_threshold: 3                       # 3+ pages deep = not a human
  window: 60s
on_match:
  classify: high_confidence_bot
  capture:
    - client_ip
    - user_agent
    - asn
  action:
    - append_to: "<shared_blocklist_endpoint>"
    - enforce_at: edge                     # block real traffic, not the maze
notes: >
  the maze wastes their compute. this rule turns the maze into a
  fingerprinting rig. the block happens at your edge on real routes,
  never inside the tar pit itself.

Fire this at the edge, in front of your production routes, once your caged maze is live. It converts the tar pit from a compute-burn novelty into a detection signal you can act on: anything that walks the decoy links past a few pages gets classified, captured, and pushed to your blocklist. Adapt the depth threshold and window to your traffic, and point the blocklist endpoint at whatever enforcement layer you already run.

Frequently Asked Questions

What is an AI tar pit and how does it stop scrapers?

An AI tar pit is a defensive trap that catches an unauthorized LLM scraper and feeds it infinite machine-generated garbage instead of blocking it. The crawler follows an endless tree of fake links that loop back on themselves, burning its compute and wall-clock time while it thinks it’s collecting real data. Tools like Nepenthes and Cloudflare’s AI Labyrinth pull it off by serving deterministic generated pages that look like stable static files, which is the one signal crawlers trust. The bot has no exit condition, so it keeps queueing URLs that go nowhere.

Can a tar pit actually poison an AI model?

Yes, and that second payload scares AI companies more than the wasted compute does. Most tar pits ship an optional Markov-chain generator that produces grammatically correct text with no real meaning. That text slips past naive quality filters because it reads like English, then corrupts the training corpus that ingests it. Fed at scale, it accelerates model collapse, the documented failure mode where models trained on recursive synthetic slop lose the tails of their data distribution and quietly degrade. Operators supply their own text corpus, so each poison is unique and harder to fingerprint out.

Is deploying an AI tar pit safe for my own site?

Not for free. A raw tar pit makes no distinction between an LLM scraper and a legitimate search engine crawler, so a careless deploy can get your site dropped from search results. Because the trap feeds crawlers exactly what they hunt for, it also draws constant bot traffic that spikes server CPU and bandwidth. Nepenthes’ own author calls it deliberately malicious software and warns operators off unless they fully understand the fallout. Cloudflare’s AI Labyrinth is the safer route, since it scopes the maze to suspected bots only and keeps it off pages real users see.

ToxSec is run by a USMC veteran and Security Engineer with hands-on experience at AWS and the NSA. CISSP certified, M.S. in Cybersecurity Engineering. He covers security vulnerabilities, attack chains, and the tools defenders actually need to understand.