ShieldFont poisons AI scrapers. It poisons buyers too.

A pair of type designers shipped the most elegant anti-scraping trick we've seen in a while: a font that lies. Humans read your page exactly as written. An AI scraper reading the raw HTML gets a grammatically clean sentence that means something else entirely. It's a genuinely good hack. For most commerce sites it is also the wrong tool, and it's worth being precise about why.

What actually happened

ShieldFont came out of embargo on July 30, built by design studio Seneda & Abrucio with Copenhagen type foundry Playtype, which adapted its Optik typeface for the job. The code is AGPL-3.0.

The mechanism is OpenType glyph substitution. You write the decoy text into your HTML; the font's GSUB table renders the original words on screen. The Register's writeup gives the shape of it: roughly a quarter of the words in a passage get swapped, nouns for nouns and verbs for verbs, drawn from a dictionary of 12,000-plus entries, so the poisoned version stays grammatically coherent and slips past the quality filters that clean scraped text before training. Three public mappings ship — Alpha, Beta, Gamma — plus private ones you can generate yourself.

The creators are refreshingly honest about the ceiling. It isn't cryptography. OCR on a screenshot defeats it. So does downloading the font file and reversing the mapping. Their stated goal is friction and cost, not prevention: a scraper can't know in advance which sites are poisoned. It's English-only today, screen readers struggle with it, and — the line that matters here — they acknowledge it could impose an SEO penalty, because search crawlers read the same raw HTML the scrapers do. So do translation tools and copy/paste.

Why AI scraper defenses matter for your business

Here's the fork. If your content is the product — you're a publisher, a studio with a portfolio, a writer whose archive is the asset — ShieldFont is a reasonable, low-cost tax to impose on people training on your work for free. Deploy it on the archive, keep it off the pages you need indexed, and you've made yourself a slightly worse deal than the site next door.

If you sell things, this is backwards. We've spent the last year writing about making your catalog legible to agents: structured product data, clean feeds, machine-readable inventory, because zero-click search means the model answering the buyer's question is increasingly the storefront. A font that feeds crawlers plausible nonsense doesn't distinguish between a scraper hoovering training data and the assistant deciding whether your product matches what someone just asked for. Both read the DOM. Both get the decoy.

The real problem ShieldFont is aimed at — you have no leverage over who trains on your words — is real. The answer for a commerce operator is boring and structural: robots.txt and crawler-level controls where your host supports them, gated content behind auth for anything you genuinely don't want ingested, and a deliberate split between pages built to be found by machines and pages built for humans only. Poisoning the well works. Just don't do it to the well you're drinking from.

Sources: ShieldFont, The Register.