The key to keeping the internet alive might be anticheats

Sun, 19 Jul 2026 13:38:48 +0200

The Dead Internet Theory is a concept asserting that the internet consists primarily of bots and automated content[1], an idea that has gotten ever more popular since the boom of Artificial Intelligence, however, I don't think it's quite true.

At the time of writing, 58.7% of the requests to HTML files passing through Cloudflare's network are initiated by bots[2], these are most certainly crawlers or scrapers, whose only purpose is to download data from a website at the highest speed possible; 52% of these crawler requests are for AI training as of June 2026[3].

According to the data, the dead internet theory is already in front of us, nonetheless, I think we might actually be experiencing the Schrödinger's internet theory: a quantum superposition of states, defining the internet both as "dead" and "alive" until an event causes it to collapse into a definite state. At the current rate of AI evolution and scraping bots being easier than ever to create with those tools, we might be threading our way towards destroying the credibility and usefulness of the internet as a source of objective information, metamorphosing what we once knew as the greatest accumulation of knowledge into a fatuous system where machines create content solely to be consumed by other machines.

I believe a solution could be found in a decades old industry: videogame anticheats.

Anticheats and the infinite treadmill

Since the invention of online games cheaters have tried to obtain an unfair advantage over other players, predominantly using software called "cheats". At first, developers tried implementing server-side checks to stop crazy exploits like flying or increasing the character's movement speed, then the cheaters became stealthy: they started simulating human mouse movement to create advanced automatically aiming bots (now called aimbots) and creating cheats that were purely visual, yet allowed them to see players through walls (ESP: Extra-sensory perception).

These types of exploits are nearly impossible to detect in the server, you can try to implement perpetually more complicated checks, or try to send as little information as possible to the player, but you will always have to tell them where nearby players are, even if they are hidden by a wall.

Developers were left with a single option, moving the anticheat to the client: if we cannot prevent cheaters from creating cheats, we will take away their ability to modify the game. And thus, the hundreds of news articles talking about invasive anticheats from multi-million corporations that track every process on your computer were born.

With that decision came a never ending treadmill, an arms race with no finish line of both parties constantly developing new techniques and reacting to each other within hours. If cheaters released a new version of their software that bypassed current protections, developers would patch it in a matter of days; if they simulated mouse movements virtually, the developers read directly from the USB ports; if the cheaters moved to the kernel, developers also moved to the kernel.

The aftermath for the users has been privacy-breaking kernel anticheats like Vanguard, and games whose developers aren't willing to jump into the treadmill, like Counter-Strike, becoming famous for the abuse players suffer due to the insurmountable amount of cheaters[4].

We are at the start of an equivalent arms race in the web protection space, where companies like Cloudflare and Vercel are starting to implement their own checks and protections to defend against scraper bots.

Moving the WAF to the client

The Web Application Firewall is supposed to be a proxy that sits between the client and the web server and decides whether incoming web requests are let through or blocked, this is done by taking into account the content of the request, the sender's behaviour and other aspects which can let the firewall know if the client is possibly a bot (or malicious). However, these proxies have evolved beyond their established position, by implementing techniques like proof-of-work checks or browser fingerprinting, which rely on client-side JavaScript to work.

Thus, the transition to the client-side has already started, but it hasn't been fully embraced, even if we cannot prevent the user from modifying the client, since we haven't developed it, behavioural analysis like done by the anti-cheats hasn't taken off in the WAF, instead being mostly present in systems like CAPTCHAs.

The CAPTCHA, or "Completely Automated Public Turing test to tell Computers and Humans Apart" can detect bots by giving the user a test that only a human could solve, some of these involve pattern recognition, reading, etc. This type of detection is present in software like reCAPTCHA v1 or hCaptcha, and is ultimately unbypassable, by the time an attacker has spent months engineering an AI to solve the CAPTCHA, the provider can just roll a new type of test. On the other hand, CAPTCHAs are extremely annoying, we cannot force the user to complete a CAPTCHA to access a website, they would just go back to Google and find another website.

The second method CAPTCHAs largely use is behavioural analysis, tracking your mouse movement, scrolls, clicks, and even keystrokes to determine if you behaviour appears to be human or not, this is used by big providers like Cloudflare's Turnstile. Right now CAPTCHAs don't try to block traffic from reaching the website, but rather actions (like posting a comment or submitting a form). Behavioural analysis could be implemented in a WAF so it invisibly checks if the user might be a bot scraping the site; but even though Turnstile's code runs in the client, it is heavily obfuscated, so their methods are unknown and the detection most likely relies on server-side machine learning models or similar proprietary solutions.

Next steps

I believe we deserve something better, current open-source solutions like Anubis (https://github.com/TecharoHQ/anubis) use proof-of-work to slow down scraper bots by making everyone perform tons of calculations before entering the website, but anyone with some patience and a basic Chromium browser automation library like Playwright or Selenium can easily download your website's data and interact with it.

In this blog I will be posting my research and attempts at creating a client-side WAF that uses behavioural analysis of the user's actions, using both machine learning and heuristics, with the code being fully public and open-source, to prevent automated bots from wrecking the internet. I will also try to ensure the user's privacy is not violated. So stay tuned, I guess!

Bibliography

[1] Wikipedia contributors, "Dead Internet theory," Wikipedia, The Free Encyclopedia. [Online]. Available: https://en.wikipedia.org/wiki/Dead_Internet_theory

[2] Cloudflare, "Cloudflare Radar – Bot vs. Human Traffic." [Online]. Available: https://radar.cloudflare.com/traffic?dateRange=7d#bot-vs-human

[3] Cloudflare, "Agentic Internet Bot Report." [Online]. Available: https://blog.cloudflare.com/agentic-internet-bot-report/

[4] Reddit user "No_Comparison9475," "CS2 Is Falling Apart, Cheaters Everywhere and Valve Doesn’t Seem to Care ", Reddit r/cs2. [Online]. Available: https://www.reddit.com/r/cs2/comments/1qrkrfb/cs2_is_falling_apart_cheaters_everywhere_and/

About

Fri, 17 Jul 2026 11:56:06 +0200