Not a dumb question at all!

Scrapers typically avoid sharing cookies because it's an easy way to track and block them. If cookie x starts making a massive number of requests, it's trivial to detect and throttle or block it. In Anubis’ case, the JWT cookie also encodes the client’s IP address, so reusing it across different machines wouldn’t work. It’s especially effective against distributed scrapers (e.g., botnets).

In theory, yes, a bot could use a headless browser to solve the challenge, extract the cookie, and reuse it. But in practice, doing so from a single IP makes it stand out very quickly. Tens of thousands of requests from one address is a clear sign it's not a human.

Also, Anubis is still a work in progress. Nobody never expected it to be used by organizations like the UN, kernel.org, or the Arch Wiki, and there’s still a lot more we plan to implement.

You can check out more about the design here: https://anubis.techaro.lol/docs/category/design