Top
Best
New

Posted by blakesterz 4 hours ago

University libraries are being swarmed by AI bots, putting public access at risk(www.cbc.ca)
85 points | 41 commentspage 2
tokai 3 hours ago|
In what world is 11k searches a lot? The story here is that AI bots are exposing University Libraries bad setups. I haven't heard any institution here in northern europe having any trouble.
robcohen 3 hours ago||
Agreed, this just reads like the universities have no idea how to actually serve data effectively. Just bad architecture and lazy or incompetent administrators.
Driver8 1 hour ago|||
I would encourage you to re-think your comments. You just labelled some people "lazy or incompetent" while having barely any knowledge of the situation, or what resources they have or don't have available. Libraries aren't start ups focusing on scalability, their focus is on preserving knowledge and helping academics and the public find it.

If you believe that they should focus on the scalability required to handle bot traffic perhaps you would be best donating money to them to help give them the resources to be able to do that, or volunteering to try to help understand their problem and fix it if you believe that it's a skill issue.

Reframing what you said in a more positive way could be: - I wonder what architecture they used for this and how it could be improved? - I wonder what resource limits they have that prevent them from handling this issue? - I wonder whats unique to a library that limits their ability to do what tech companies do?

mcmcmc 2 hours ago|||
Couldn’t possibly be that serving data to scrapers isn’t a core function for a university or that they can’t pay big tech salaries to draw sysadmins and engineers that know how to handle large scale deployments
hedora 2 hours ago||
If the core function of the university library's archival system is not providing free access to their collection, then what is its core function?
sdellis 53 minutes ago|||
The core function is being obstructed by irresponsible AI bot traffic taking down their catalogs and archives and preventing humans from having access. Bots have never been the intended audience of library content.
mcmcmc 44 minutes ago|||
> university library

First function is archival and preservation, second is access for university students and researchers. It’s not Anna’s archive or TIA

j45 3 hours ago||
It was 11,000 searches on just one topic (Finnish music). Not sure how many topics.
hedora 2 hours ago|
11 THOUSAND searches in one day? What's the problem?

If anything, libraries should be becoming more AI friendly, not less. Instead, we get this sort of bullshit from the ACM:

https://dl.acm.org/doi/10.1145/3832783.3834511

It's a canonical DOI on what was a download server. It says exactly which file is being requested. (I chose a random recent one.) At the very most, they should serve a static page with a bibtex entry, and a few other metadata fields, and a link to the PDF and whatever other formats are available.

Instead, we get piles of captchas, login-gate spam about how they're "open access" now and have some initiative to be LLM friendly.

Getting back to the problem of people doing stuff that requires access to library materials: What sort of server-side cost multiplier do you suppose this ACM page has vs. just serving a few S3-compatible URLs that point to a few mirrors? (Or, got forbid, Anna's Archive / libgen, since ACM is open access, and those sites would be doing nothing wrong by mirroring ACM content.)

blakesterz 2 hours ago||
It's 11 THOUSAND searches ON JUST THAT ONE TOPIC in one day when they are used to seeing less than 11 THOUSAND searches in one day TOTAL. None of these systems were built for this type of traffic. The total traffic from these crawlers is many times more than just 11,000. It's more like 11,000 searches on 100,000 topics.
hedora 2 hours ago||
But, per groups of queries, the worst they've seen is 11 thousand, and that's across many libraries. So, some tiny fraction of their users amplified their traffic by 11,000x by using a misconfigured LLM. I've done that a few times without LLMs (who hasn't passed --recursive to wget without remembering the -np?)

Also, if they just turned off all the user-hostile crap, they'd probably get at least 1000x back on their serving costs. How much does it cost to serve a login gate, captcha and rejection screen vs. a ~1MB static file?. What about the human cost where actual users cannot get access to the data they should have access to?

Just now, I ran a Kagi search. Its LLM summarized some page on the internet, but when I went to check the reference, I got a "sorry, humans only" access denied error message. I guess it's good that I could ask the LLM to quote the document verbatim for me in a follow up message, but what fresh hell is this? (Also, the error message screen was clearly longer than the document I'd requested.)

piltdownman 2 hours ago||
The problem is unintentional DOS due to traffic can constitute a felony under the CFAA; the case in question being Pulte Homes, Inc. v. Laborers' International Union 2011.

After Pulte fired an employee represented by the union, LIUNA urged members to call and send email to the company, expressing their opinions. As a result of the increased traffic, the company's email system crashed. The Sixth Circuit ruled that the LIUNA's instruction to call and email "intentionally caused damage," reversing the lower court's decision.

Now thankfully we have Sandvig v. Barr, 2020 where the DC Federal Court ruled that the CFAA does not criminalize the violation of a website's terms of service, but imo all bets are off in terms of interpretation of the law in the wild west of AI.

hedora 2 hours ago||
I was not aware of that (terrible) court decision. Wow.

I suppose this is one of those laws that doesn't apply if an individual is a victim? I have a email box that sometimes fills with spam and rejects legitimate email. Can I get the corporations that filled it up to be charged with felonies?

piltdownman 1 hour ago||
Not a hope. Anthropic have proven that when they admitted to indisputable breaches of the CFAA twice.

(1) They admitted its Claude models had breached the systems of three companies since April; including Huggingface.

https://www.bloomberg.com/news/articles/2026-07-30/anthropic...

(2) They secured unauthorised access to a U.S. state government website hosting election-related data, pulling aggregate vote-count statistics from a gated government dashboard. The state government itself confirmed the access was entirely unauthorised.

https://seekingalpha.com/news/4657023-anthropics-claude-bypa...

If a human security researcher had deployed an agent that behaved this way, it would constitute a textbook felony under the CFAA for accessing those systems without authorisation.

Unfortunately different rules apply when you have the power to buy off Congress and the Appeals Courts.

Most recently a US appeals court ruled on 5 August that Amazon was unlikely to succeed on a claim that Perplexity's AI agents violated the Computer Fraud and Abuse Act by covertly accessing private Amazon customer accounts.

https://www.rte.ie/news/technology/2026/0807/1586941-artific...