A Glitch Exposed Reddit's Secret Spam Machinery: 'Spamurai,' Perspective API Scores, and TLS Fingerprinting

In June 2026 security researcher rebane2001 published a teardown, years in the making, of Reddit's internal spam-filtering machinery — made possible by a 2021 glitch: 'due to some kind of an error on Reddit's side, the usual Removed: Auto text had been replaced with the actual removal reason.' Instead of the opaque 'Removed: Auto,' moderation logs briefly showed entries like 'Removed: Reddit (shadowban applied on 10-27-2021)' and internal scoring output.

The leaked reasons exposed a system called 'spamurai' and, most notably, showed Reddit scoring private messages with Google's Perspective API — the toxicity-scoring service. The researcher verified the finding experimentally: a message's leaked score of '0.12571795 perspective spam' could be reproduced against Perspective's public API, 'and thus, we can be 100% sure that this is the API Reddit used, because we get back the same 0.12571794 as we saw in spamurai earlier.' That equivalence had a security implication: 'it means that this entire time it was possible for a bad actor to bypass one of the primary spamurai criterias by just changing their message until it's non-spammy for Perspective's free API.'

The exposed metadata went beyond content scoring. Entries included what the researcher identified as browser fingerprinting hashes ('RHS: oc:ac:kT:lw:bV:aX…: this seems to be some sort of a fingerprinting hash Reddit uses'), TLS fingerprinting 'similar to JA3,' and ISP-level profiling ('org: Skyinfo Online: the ISP of user. This can tell you where the user is from and whether they're using a VPN'). Testing the system's aggressiveness had costs: 'My test account (5 years old!) got banned immediately, and all of its post history got wiped too.'

The teardown tied its findings to Reddit's own engineering disclosures — a 2023 r/RedditEng post, 'Protecting Reddit Users in Real Time at Scale,' describing internal enforcement systems named Rule-Executor-V1, REV2, and Snooron — and to regulatory filings: an Australian eSafety Commissioner PDF listing Reddit as using, as of 2024, Hive AI for OCR and image/video classification alongside the Google Vision OCR API. Together the documents sketched what Reddit's transparency reports do not: the concrete third-party AI services, fingerprinting techniques, and automated ban logic applied silently to users' posts and private messages.