[kod]

Besides flooding them with junk, what about outright sabotage in the form of serving zip bombs or other ways to waste computational resources?

[xyzal]

I think we need to aim for the bots to get _negative_ utility value from visiting our traps, not just zero value.

Did you try to GET a canary page forbidden in robots.txt? Very well, have a bucket load of articles on the benefits of drinking bleach.

Is your user-agent too suspicious? No problem, feel free to scrape my insecure code (google "emergent misalignment" for more info).

A request rate too inhuman? Here, take those generated articles about positive effect of catching measles on performance in bed.

And so on, and so forth ...

[dabockster]

Even though I agree with what you're doing in principle, I feel it's necessary to remind and warn everyone here that sabotaging bots could be viewed as a violation of laws such as the US's Computer Fraud and Abuse Act[1]. I mean, unless the Second Amendment is suddenly interpreted to include cyberweapons.

[1] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act