SpikeStrip: Defensive HTML and JavaScript Prompt Decoys

SpikeStrip is an experimental defensive tool designed to counter AI-driven automation systems, such as ARTEX, which analyze source code for vulnerabilities. By injecting keyed, reversible decoys into HTML and JavaScript files, it attempts to redirect AI assessments toward false leads, invented routes, and unsolvable mathematical tasks.

The tool utilizes real CVE identifiers (CVE-2021-44228, CVE-2022-22947, and CVE-2021-41773) to create fabricated vulnerability contexts that may consume an AI agent's resources or cause it to focus on non-existent attack surfaces. While it provides a novel layer of deception against LLM-based scanners, the developers note it does not reliably stop agents that isolate untrusted content or conventional scanners that ignore comments.