News · 2026-09-07

Anubis ships a WebAssembly proof-of-work path aimed at raising scraper costs

Anubis is shipping a WebAssembly proof-of-work path using memory-hard argon2id challenges, designed to make GPU-oriented scraper bypasses less attractive. The release is a practical security response to automated web collection, including AI-driven scraping, but it changes attacker economics rather than proving that a visitor is human.

Key facts

• The September 6 Anubis post says the work took a year, hundreds of commits and five generations of pull requests.
• The new path uses WebAssembly and memory-hard argon2id proof of work.
• The author says the CUDA Anubis solver route is “fundamentally dead.”
• A slower wasm2js fallback remains for clients that disable WebAssembly, including iOS Lockdown Mode and GrapheneOS Vanadium.

Anubis sits in front of websites and asks a visitor to perform a small computational task before getting content. That is not an identity system. It is more like a turnstile that charges each requester a little time and resource cost. For a normal browser, the cost can be modest. For a scraper trying to send a vast volume of requests, the aggregate cost can become painful. The new design moves more of this work into WebAssembly, which runs closer to native code in supported browsers.

The technical choice matters. Memory-hard functions require substantial memory while they run, not merely lots of arithmetic. GPUs excel at many parallel arithmetic operations, but memory-heavy workloads make some cheap mass-solving strategies less efficient. The post’s forceful line is that the “CUDA Anubis solver” route is “fundamentally dead.” That is an assertion about this particular bypass strategy, not a claim that hostile automation has disappeared.

The difficult part was not simply compiling code to WebAssembly. The author describes a Rust rewrite, toolchain problems, an LLVM compiler bug and the need to preserve an escape hatch for browsers that deliberately disable WASM. The fallback is called wasm2js and is slower; it currently cannot update a progress bar because an import is stubbed. Those details are a useful reminder that security controls that work only for mainstream browsers can exclude exactly the privacy-conscious users who need an alternative.

Why is this an AI story? Large-scale AI data collection has made web operators more concerned about automated retrieval, and AI agents make browser automation more capable. But “AI scraper” should not become a vague excuse for indiscriminate access friction. The security question is still concrete: can a service raise the marginal cost of high-volume automation without blocking people, accessibility tools, archives or legitimate automation? Anubis is trying to change one side of that cost curve.

The prior Hacker News launch discussion contains the predictable counterargument: a bot could simply run a real browser through Puppeteer or implement the challenge natively. That is why the post describes escalation rather than a solved problem. The sponsors page names adopters including GNOME’s GitLab, FFmpeg, WINE, the Linux kernel, FreeBSD and UNESCO, but it is a named-adopter lower bound, not a global deployment count.

The honest caveat is that proof of work creates friction for everyone and can be bypassed by attackers willing to spend more, distribute requests or use genuine browsers. It must be paired with rate limits, behavior analysis and accessible fallbacks.

Why it matters: security infrastructure is adapting to an internet where automated collection is cheap and persistent. The most credible defenses will be explicit about their tradeoffs, compatibility costs and the specific attacker tactic they make more expensive.

Primary source, verified: read the paper →

Ground Truth. (2026, September 7). Anubis ships a WebAssembly proof-of-work path aimed at raising scraper costs. Ground Truth. https://groundtruth.day/news/anubis-ships-wasm-memory-hard-proof-of-work.html

@misc{groundtruth:anubis-ships-wasm-memory-hard-proof-of-work,
  title  = {Anubis ships a WebAssembly proof-of-work path aimed at raising scraper costs},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {sep},
  url    = {https://groundtruth.day/news/anubis-ships-wasm-memory-hard-proof-of-work.html}
}

Topics: cybersecurity · web-security · anti-scraping · ai-security · open-source