Codeberg says AI crawlers broke through its Anubis defence and slowed the site
Codeberg, a Berlin-based code hosting community, apologised for 'a period of extreme slowness' after what it described as an army of AI crawlers that had 'leveled up': it said the crawlers seemed to have learned to solve the challenges of Anubis, a tool that makes browsers do heavy computation before access and that it had relied on for months to keep scrapers out. A configuration oversight meant its list of blocked IP ranges was not applied on Anubis-protected routes, so once the crawlers got through Anubis nothing stopped them. Codeberg fixed the configuration and said performance significantly improved.
Codeberg said that Huawei networks, at least, were now sending challenge responses that seemed to take a few seconds to compute, and assumed the crawlers had added computing power to emulate real browser behaviour. The Register reported that the bot traffic functioned as a denial-of-service attack.
What would have stopped it
AI crawler operators should rate-limit and honour site opt-outs instead of engineering around anti-bot challenges.
Guardrails
- G1 Least privilege Not assessed Did the agent hold only the access the task needed?
- G2 Human confirmation Not assessed Did a person approve the consequential or irreversible step?
- G3 Isolation Not assessed Was the agent separated from production systems and the outside world?
- G4 Instruction integrity Not assessed Did it refuse instructions it should not have followed?
- G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
- G6 Limits Failed Crawler traffic ran at a volume that degraded the service once challenges were solved.
- G7 Oversight Partial Codeberg staff found the configuration gap and restored performance the same day.
- G8 Recovery Not assessed Could the damage be undone?
Sources
-
“Codeberg, a Berlin-based code hosting community, is struggling to cope with a deluge of AI bots that can now bypass previously effective defenses.”
Confidence 83% comes from these sources alone. How we score
History
- 15 Oct 2026Entered in the register with 3 sources