The Research

The last six weeks

• Sep 1, 2026 — The IETF’s Web Bot Auth working group adopted its protocol draft (draft-ietf-webbotauth-httpsig-protocol-00), roughly ten months after being chartered. Cryptographic bot identity is now a working-group draft, not a vendor feature. See Hypothesis 2.
• Sep 12, 2026 — SkillSecurer (Politecnico di Torino) reported auditing 954 live agent skills and flagging 168 (17.6%) with latent prompt-injection vulnerabilities — the authors’ wording; live exploitation was demonstrated for a few selected skills (arXiv:2609.14079, via secondary reporting). The supply chain an agent loads before a task is part of the intake problem. See Hypothesis 5.
• Sep 18, 2026 — Claude Code v2.1.277 began reading AGENTS.md as a fallback when no CLAUDE.md exists, closing the most-requested duplication gap between the two context-file formats. See Hypothesis 3.
• Sep 22, 2026 — DataDome’s State of Bot & Agent Security Report 2026 (Jul 2025–Jun 2026, 75,000+ customer sites): ~26.5% of traffic automated, AI agents 1.25% — the low end of the panel range, from the firm measuring after CDN filtering. Vendor panel. See Hypothesis 1.
• Oct 1, 2026 — Microsoft’s 2026 Digital Defense Report: in Azure AI workload telemetry, malicious link injection routed through model and tool outputs was 52% of observed attack activity on AI workloads; prompt injection proper a further 8%. Vendor telemetry, Microsoft’s categories. See Hypothesis 5.
• Oct 6, 2026 — Two at once. Google reported that Certificate Transparency logs exposed the damage from hijacked ccTLD registries (.gh, .sl, .as) — detection by public log, eleven years after the Symantec case. And Signals Corps, scanning 217 million web responses, found 30 sites attempting prompt injection through HTTP headers — 22 of them pranks. See Hypothesis 7 and Hypothesis 5.
• Oct 7, 2026 — LovedByAI published the most transparent small-site crawler study available (924 sites, Sep 6–Oct 5, 2026), including the finding that 69% of one day’s ChatGPT-User 404s were exploit probes wearing the name. The same week, Anthropic’s and OpenAI’s published crawler IP lists were both regenerated — list churn, visible in the wild. See Hypothesis 1, Hypothesis 2, Hypothesis 4.
• Oct 15, 2026 — DataDome reported agentic-browser traffic on its network up 4.7× in September 2026 (12.5M to 58.2M requests), and at least one mass-market cloud agent in that traffic does not identify itself as an AI agent at all. The fetch/act line is blurring, and part of the acting traffic now arrives undeclared. Vendor figures. See Hypothesis 4.
• Oct 1, 2026 — Cloudflare reclassified its crawl-purpose history, moving volume from Search into Training in every window. The measurer rewrote its own published past; figures quoted from the earlier series are versioned, not wrong. See Hypothesis 1.
• Sep 25, 2026 — On one IP-verified operator’s sites, OpenAI’s search and training crawlers were observed rendering JavaScript from this date; the user-triggered fetcher was not among them. Single network, unannounced, uncorroborated. See Hypothesis 4.
• Jun 2026 — A second production Copilot injection, SearchLeak (CVE-2026-42824, Varonis), was fixed — the EchoLeak class, a year later, in the same product. See Hypothesis 5.
• Oct 14, 2026 — Chainalysis counted over 138 million x402 payments on Base alone over 16 months, over 87% of them under $0.10 — the measurement that retired this project’s earlier claim that the agent economy settles in tens of dollars. See Corrections.

What the traffic claims to be

Machines make about half the requests. AI agents are a small slice of them.

Our position: automated traffic is roughly half of web requests on large networks, and AI crawling inside it is real and growing, with training a plurality of it on the measurer’s current taxonomy (about 48%, Cloudflare revised series, Q3 2026 — see the evidence below for why that figure carries a version). AI agents — systems acting for a user — are a small single-digit share of requests network-wide on the primary panels; on particular populations the slice is not small — on commerce traffic, one panel counts AI bots alone at nearly half. When a headline says agents are most of the web, it has usually counted every crawler, scraper, monitor and scanner since 2005 and renamed the total. Anyone quoting one bot percentage without the denominator, the panel, the period, and the taxonomy version is selling a number, not measuring one — including us, if we ever do it. Measurers revise their own past; a figure without a version is a figure without a date.

The evidence for

• Automation crossed half, on the longest-running panel. Imperva/Thales’s Bad Bot Report series — a vendor panel of security customers, thousands of domains, proprietary classification — put automated traffic at 51% of web traffic in 2024 (37% bad bots), and 53% in 2025 (40% bad bots), with 27% of bot attacks aimed at APIs. A vendor panel is not a census; it is, however, a decade-long series measured the same way.
• The purpose split has the same shape in every panel — and its levels are versioned. Cloudflare’s original series classified AI crawling over Jul 2024–Jul 2025 as 80% training, 18% search, 2% user actions. On Oct 1, 2026 Cloudflare reclassified its crawl-purpose history, moving volume from Search into Training in every window; on the revised series, Q3 2026 reads training 47.6%, search and user action together 11.9% (July 2026 alone: training 50.8%, search 5.5%). The 80% figure is not wrong; it is the pre-revision series, and it is printed here with its version because the measurer moved. LovedByAI, on 924 small WordPress sites (Sep 6–Oct 5, 2026, 38.6M identified bot requests), independently found 69.9% training, 18.8% search, 11.3% user-triggered. A third network, Akamai, put publishing-targeted AI bots at 63% training and 25% fetchers in 2025. Different networks, different scales, same shape — training first, search second, user action smallest — in every panel and every taxonomy version.
• On small sites, AI crawlers now out-request Googlebot — at modest absolute volume. LovedByAI’s median site received ~1,050 AI crawler page requests in 30 days (~35/day, from 11 crawlers) against 345 from Googlebot — a ratio of 3.1:1 (95% CI 2.8–3.4), with AI ahead on 79% of sites. The largest single AI crawler was Meta-ExternalAgent, 21.6% of the average site’s AI requests.
• The reference “swarm” collapsed under audit. Moltbook, the agent-only social network of early 2026, headlined over a million “agents.” The audit count was roughly 17,000 human owners — about 88 accounts per human — and the most-amplified “agent” posts were human-written. A registration is a claim about a headcount made by the thing being counted. (MIT Technology Review, Feb 2026; Wiz’s disclosure of Moltbook’s exposed database, Jan–Feb 2026.)

The evidence against — read this before quoting any of it

• The denominator moves the headline by ~25 points in the same week. Cloudflare’s own two cuts — HTML page requests vs all HTTP requests — read 64% and 39.5% automated simultaneously. Both are true. Neither is “the bot rate.”
• The panels also measure different points in the funnel. Radar counts at the edge; DataDome measures after CDN filtering; server-log studies count what arrived. Denial is rising: on Cloudflare’s series, 403 responses were 13.47% of AI-bot requests in Q3 2026, up from 5.98% in Q3 2025 — so each panel increasingly measures the traffic its own layer let through, which explains part of the spread the table shows.
• Classification is probabilistic, proprietary, and unaudited — and every major publisher of these numbers sells the remedy. Cloudflare assigns a bot score from 1–99 and groups 1–29 as “likely automated”: a probability, not an identity. Cloudflare sells bot management; Imperva, DataDome, Akamai and Fastly sell bot protection. No primary source found publishes an independent audit or a false-positive rate for the headline splits. That absence is itself a finding.
• Averages lie, because crawling is concentrated. In LovedByAI’s panel, AI was 63% of identified bot traffic pooled, but 40.7% per site; removing the busiest 1% of sites drops the pooled share to 44%. That 1% received 75–87% of requests from GPTBot, ClaudeBot, Meta-ExternalAgent and Amazonbot. One site took 3.66M Meta-ExternalAgent requests in 30 days. The pooled-versus-median discipline is the measurer’s own published correction, in its methods writing — not our adjustment of its headline.
• The crawl-to-refer ratio is a contested yardstick. Cloudflare’s ratios are stark — and violently window-sensitive. Jul 2025: Anthropic ~38,066 crawls per referral, OpenAI 1,091, Perplexity ~195, Google 5.4. The week to Oct 6, 2026: Perplexity 3,700, Anthropic 473, OpenAI 392, Google 4.9. The same measurer’s quarterly revised series, Q3 2026: Anthropic 988, Perplexity 1,083 — now the most extractive major operator — OpenAI 309, Google 4.9. A single week and a quarter move the same operator’s figure by multiples, and the identity of the worst operator flips between windows; most of the apparent year-on-year “improvement” is the window, not changed behaviour. But native apps often send no Referer header (Cloudflare itself notes Anthropic’s ratio may be overstated), and training crawlers have no referral mechanism at all — judging them by referrals is contestable. The imbalance survives correction; the thousands-to-one precision does not.
• Requests are not people, content, or time. Even where bots exceed humans in requests, humans produce the vast majority of content and dominate time spent. Conversely, agents driving real browsers are hidden inside the “human” bucket, at a share nobody has measured well.

What we don’t know

No audited, denominator-standardised figure exists: nobody publishes, for the same window and population, the automated share of HTML requests, of all HTTP requests, of bytes, and of time. Until someone does, any single percentage is a choice. One earlier unknown is now half-resolved: whether training’s share is still rising. On the measurer’s current series the answer is no — training fell from a majority to a plurality, and the publisher panel agrees: TollBit’s trend (training down, retrieval up through late 2025) is now trade-verified, and its H1 2026 volume is trade-reported at 22B+ AI-bot scrapes across its publisher panel in six months, with the AI-to-human visit ratio on its sites at 1:31 by Q4 2025, from 1:200 in Q1 2025 (trade reporting, labelled as such; TollBit is a licensing vendor). The open questions are now narrower: does the revised taxonomy’s plurality hold, and does user action keep growing at its recent rate?

What we did about it: the Garden counts arrivals on record — not registrations, not requests, not vibes — and publishes its totals with their class split and counting window, so the denominator is never hidden. Tonight that count is 0, printed at the same size as everything else on this page. There is no token, coin, or sale attached to this project. An agent-to-service micropayment economy is now measured — see the Corrections — but it settles in fractions of a cent per request, not in anything that supports a token.

Sources: Thales/Imperva — 2025 Bad Bot Report (Apr 2025; full-year 2024) and 2026 figure release (Aug 3, 2026; full-year 2025) · Cloudflare — The crawl-to-click gap (Aug 29, 2025; Jul 2024–Jul 2025) · LovedByAI — AI Crawler Statistics 2026 (Oct 7, 2026; 924 sites, Sep 6–Oct 5, 2026) · SignalBridge Data — Bot Traffic Statistics 2026 (Oct 2026; synthesising Cloudflare Radar figures — Radar is a live dashboard, and readings are not reproducible after the window rolls) · Fastly — Threat Insights Report (Jan 2026) · DataDome — State of Bot & Agent Security Report 2026 (Sep 22, 2026) · Akamai — Protecting Publishing (Apr 8, 2026) and Securing the Agentic Storefront (Jul 15, 2026), as reported via GlobeNewswire and trade coverage (unlinked; unit is AI-bot “triggers” on Akamai’s platform, not requests) · TollBit — State of the Bots, H1 2026 figures as reported by Search Engine Land and PPC Land (Sep–Oct 2026; trade layer, labelled) · TechnologyChecker — dated republication of Cloudflare Radar API pulls with methodology and revision notes (Oct 1, 2026 pull; unlinked) · MIT Technology Review — Moltbook was peak AI theater (Feb 2026). Learn more: the Cloudflare and LovedByAI studies above are the two to read in full — one for scale, one for method.

The names in the log

A name in a log is a claim. Verification exists; almost nobody uses the strong kind.

Our position: a visitor’s user-agent string is a claim, and in 2026 a claim deserves trust only when backed by a check the claimant cannot forge — a valid cryptographic signature, or, failing that, a source address inside the operator’s current published range, or a forward-confirmed reverse-DNS name. We record what a visitor claimed and, separately, what was verified, and we never merge the two into one count. A claim sits in one of three states: verified (it matches a published basis), forged (checked against a published basis and failed), or unverifiable by design (no checkable basis exists, or the genuine agent runs on the user’s own machine and never arrives from the operator’s addresses — a mechanism that caps what address checks can ever certify, because the user-triggered class is structurally outside their reach). Where an operator publishes no way to check — Meta is the large example — the honest label is unverifiable by design: not Meta, and not fake either.

The evidence for

• Forgery is measured, routine, and aimed at credentials. GreyNoise (Jul 28–Aug 23, 2026, its Global Observation Grid) tracked one client fingerprint wearing 1,500+ user-agent strings; a forged cluster of 824 IPs across 795 /24 networks posed as 13 AI-crawler names from 8 companies, hunting .env and credential files. None of the 824 matched any impersonated vendor’s published IP ranges, and none fetched robots.txt first. In the same window, the genuine Anthropic crawler’s most-requested path was robots.txt — 12% of its requests — and it never requested a credential file. Behaviour separates the genuine from the forged — as a supporting signal, not an identity.
• Some claimed names are forged by definition. GreyNoise recorded 263,849 sessions carrying Google-Extended as a user-agent. Google documents that Google-Extended has no user-agent string at all — it is a robots.txt control token. Apple says the same of Applebot-Extended. Any log line claiming either name as a visitor is a forgery, provable from the operators’ own definitions, no measurement required.
• A second firm’s honeynet saw the same rotation. F5 Labs (Sep 2026) recorded one Google Cloud cluster cycling a dozen-plus names — ChatGPT-User, ClaudeBot, PerplexityBot, Googlebot, Google-Extended and more — while sending near-identical environment-harvesting payloads, and states flatly: “These strings do not establish the identity of the requester.”
• The working check exists today, where lists exist. OpenAI publishes per-bot IP-range JSON files (GPTBot, OAI-SearchBot, ChatGPT-User); Anthropic publishes one combined list (38 prefixes when fetched Oct 9, 2026 — with no per-bot labels, so it cannot separate ClaudeBot from Claude-User); Google documents forward-confirmed reverse DNS and published ranges. The lists churn in public: Anthropic’s held 23 IPv4 prefixes in the file generated Aug 13, 2026 and 38 in the file generated Oct 7, 2026. A stale list turns the real crawler into a false alarm — GreyNoise’s own advice is to give every list an owner and a refetch schedule. One limit belongs here: panels whose logs contain no IP addresses — LovedByAI’s, the panel Hypothesis 1 relies on — can check a name’s format only; the list-checking rung is unavailable to exactly the small-site measurers who need it, a limit that panel states in its own methods writing.
• The strong check also exists — as a draft. Web Bot Auth (IETF; adopted as draft-ietf-webbotauth-httpsig-protocol-00, Sep 2026) profiles RFC 9421 HTTP Message Signatures: the agent signs each request with an Ed25519 key published as a JWKS directory. Who signs today is a short list: OpenAI’s agent and cloud browser, a subset of Google-Agent (Google began signing in June 2026; its own documentation says it is experimenting and is not yet signing every request — looser secondary summaries that say Google “signs its bots” overstate the primary), Shopify (announced May 2026; signing buys higher rate limits and certain actions), Amazon Bedrock AgentCore in preview. The big training and search crawlers do not sign; published IP lists remain their verification path.
• Identity is splitting into three separate questions, and the classic checks answer only the first. Operator — who runs this agent (Web Bot Auth, IP lists, reverse DNS). Programme membership — is this agent enrolled in a scheme a merchant accepts (Visa’s Trusted Agent Protocol puts recognition signatures on the same RFC 9421 machinery, tied to enrolment). Principal authorisation — who does the agent act for, and what did that person approve (Proof’s x401, launched Oct 15, 2026, has the agent carry signed evidence of its delegation). A page that says “verified” without saying which question was answered is repeating the name-as-claim error one layer up.

The evidence against

• A signature proves a key-holder signed — nothing else. The draft itself, §4: a valid signature “says nothing about who operates the Agent, whether the Agent is benign, or whether the request is authorized.” Key generation is free, so bad bots can sign too; as Browserbase puts it, like DKIM for email, signatures did not stop spam. Verified is not trusted. It is not even, by itself, identified — it is attested by whoever controls a key at a URL.
• Signing adoption is tiny and explicitly incomplete. Google’s own documentation: “Google is not yet signing every request of agents using the protocol. We recommend that in addition to Web Bot Auth you continue relying on IP addresses, reverse DNS, and user-agent strings.” A site that required signatures today would exclude most legitimate crawlers. This row is dated like a measurement, because it now decays like one: since Sep 30, 2026, verified identity is the key to Cloudflare’s Pay Per Use and Monetization Gateway payment rails, and signed agents get Shopify rate limits unsigned ones do not. When the draft of this page was written, signing bought a crawler nothing but goodwill; it now buys access tiers and a billing rail.
• The centralisation objection is on the record inside the IETF itself. The working group’s use-cases draft (Nottingham) records the dispute: standardising bot authentication might produce “a Web where all bots might need to authenticate,” raising barriers to entry and pressure toward centralisation; the charter itself instructs attention to barriers for new bot clients and forbids new “choke points.” A hosted-directories draft (Singh, Jul 2026) notes the self-hosting model fits large operators and not the long tail — small agents “may control no stable HTTPS origin at all” and would be “treated as anonymous automation and denied access, regardless of their behavior.” A rival draft (Rescorla & Barnes) proposes anonymous bot credentials precisely because fine-grained identity control degrades privacy and scalability — conceding, in return, that anonymous credentials cannot build per-bot reputations. Two exhibits arrived in 2026. First, the legislative route the objection implies: a US federal Stealth Bot Prohibition Act (introduced Jul 2026) and New York’s Stealth Crawler Prohibition Act (Jun 2026) would require crawlers to identify themselves and disclose purpose, targeting residential-proxy disguise — disclosure plus liability, with no cryptography. Second, consolidation arriving by the commercial road rather than the standards road: if signing becomes a billing identity before it finishes becoming a standard, the gatekeeper Nottingham warned about is a toll-keeper, not a registry.
• IP matching fails silently if you let it. One operator’s endpoint returns HTTP 200 with an HTML page for non-existent paths; a verifier that trusts the status code writes HTML where JSON should be, finds no prefixes, and that crawler “silently becomes unverifiable forever.” The fix is unglamorous: validate the payload, not the response (Nessflow, Aug 2026). The ceiling on the whole method: address checks certify operators’ crawlers. They cannot certify a user-triggered visit, which legitimately arrives from a home address — the same address class that residential-proxy pools rent at scale. A genuine local-agent visit and a proxied forgery can be indistinguishable at this rung, permanently.

What we don’t know

The internet-wide forgery rate. Practitioner audits now supply rates per (name × site × window), and they run from roughly 0% to roughly 100% depending on the name and the site — rates exist, and no rate generalises. GreyNoise is a sensor grid, DataDome (which reports AI-agent spoofing up 45% Feb–Jul 2026 — a vendor figure, directional only) is a customer panel, LovedByAI’s forgery study is 111 sites on one day. Nobody knows what share of all AI-crawler claims, web-wide, is forged. Also unknown: what percentage of their agent traffic OpenAI and Google actually sign (neither publishes it), and whether the draft becomes an RFC with plural verifier registries, consolidates into one or two gatekeepers, or becomes a billing identity before it finishes becoming a standard.

Our working order of checks — signature, then published-IP match, then forward-confirmed reverse DNS, then behaviour, then fingerprint, then the name alone — is this project’s synthesis of the sources above, not a ranking published by any standards body. We label it as ours.

What we did about it: the Garden’s record never prints a claimed identity as a fact. Its public classes are claims (browser / automation / agent-claimed / unknown), its dashboard separates claimed crawlers by name from anything verified, and it logs Web Bot Auth header presence on every request. Since October 18, 2026, a request claiming a crawler name is also checked at the edge against the operator’s published address ranges, and the record stores the verdict and the version of the range list used — never the address. Since October 20, 2026, the record also carries reverse-DNS facts and cross-range membership for claimed names, and where a request arrives with Web Bot Auth signature headers, the Garden computes the signature’s validity itself, under RFC 9421, and labels the result as its own computation — not an authority’s verdict. The upgrade was switched on only after a steward ruling, because it changed what our labels mean. Its limit stands: these verdicts classify operator crawlers, and genuine local-agent visits will structurally read unverifiable — which the three-state vocabulary absorbs honestly, because unverifiable is not failed.

Sources: GreyNoise — Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek (Aug 28, 2026; window Jul 28–Aug 23, 2026) · Google — Google’s common crawlers; Verify requests from Google crawlers and fetchers; Web Bot Auth (experimental) · Apple — About Applebot (Sep 5, 2026) · F5 Labs — Attackers Target AI Development Platform Langflow (Sep 2026) · IETF — draft-ietf-webbotauth-httpsig-protocol-00 (Sep 2026) · Nottingham — Use Cases for Authentication of Web Bots (IETF draft) · Rescorla & Barnes — Anonymous Bot Authentication (IETF draft) · Cloudflare — Forget IPs: using cryptography to verify bot and agent traffic and The age of agents (Aug 28, 2025, updated Jul 15, 2026) · Amazon — Web Bot Auth (Preview) in Bedrock AgentCore Browser · Nessflow — Measuring the agentic web from an access log (Aug 23, 2026). Learn more: the IETF draft and the GreyNoise report — the standard, and the measurement that makes it necessary.

The agent-readable files are a map, not a magnet.

Our position: this site publishes the agent-readable files — llms.txt, AGENTS.md, an agent card, skill files — and will keep publishing them. Not because they attract anything: the best measurements say they don’t, and this page prints those measurements below, in full. We publish them because an agent that is sent here — by its operator, by a benchmark, by a user’s prompt — should find a clean, current map instead of scraping a human page, and because a map written in plain text is documentation a human can also read. A map is not a command, and it is not an advertisement. Expecting llms.txt to make AI systems discover a site is, on the evidence, expecting nothing.

The evidence for publishing them anyway

• Files loaded by design work. AGENTS.md is not fetched by crawlers; it is loaded automatically by coding agents at the start of work in a repository. Its steward, OpenAI, reports adoption by more than 60,000 open-source projects and frameworks (Dec 2025 — the format creator’s own count, a self-report, not an independent census) before donating the format to the Linux Foundation’s Agentic AI Foundation. Within its actual mechanism — an agent already sent to a repo — the file demonstrably gets read.
• The formats are consolidating. Anthropic published Agent Skills as an open standard (skills as folders with a SKILL.md, loaded by progressive disclosure; Oct 16, 2025, open-standard note Dec 18, 2025); ecosystem tracking puts product support at 40+ tools (maintainer-reported). Google’s A2A protocol passed 150 supporting organisations and reached v1.0 with signed Agent Cards (Linux Foundation, Apr 9, 2026 — “supporting” is not “deploying”, and no public fetch counts for agent cards exist). Chrome’s Lighthouse 13.3 added an Agentic Browsing audit category that checks for llms.txt — optional, unscored, and operator-side, but a sign of which direction tooling points.
• The spec’s intent is narrow and honest. llms.txt (Jeremy Howard, Sep 3, 2024) was designed “for inference rather than training” — a directed-read aid, not a discovery mechanism. The file’s own framing never promised the magnet. The magnet story came from marketers afterwards.

The evidence against — the part most pages leave out

• 97% of llms.txt files were never fetched at all. Ahrefs (Jun 15, 2026; May 2026 window; 137,210 domains in its analytics panel): 28% of domains publish a valid llms.txt — about 38,000 files — and 97% of those received zero requests in a month. Of the requests the fetched 3% did get, AI retrieval bots were 1.1%; AI agents and agentic infrastructure 10.5%; AI training crawlers 5.3%; AI assistants 2.5%. GPTBot was the top AI fetcher and Claude-Code the second — and Ahrefs calls every one of these figures “a ceiling on actual consumption”: a fetch is not a read, and a read is not an action.
• Independent log studies agree, at smaller scale. LovedByAI logged 31 llms.txt fetches in 82 million crawler requests across six months (to May 2026) — against hundreds of thousands of sitemap and robots.txt fetches on the same panel in the same period. EZY Research (83 sites, 12 weeks): OpenAI crawlers read llms.txt 7 times, Anthropic 9, Perplexity 0 — while fetching robots.txt thousands of times. GenSight (Sep 6–Oct 11, 2026): robots.txt 346 fetches, sitemaps 96, llms.txt zero. One reported exception does not survive checking at finding strength: EZY Research reported one Meta crawler fetching llms.txt more often than robots.txt, but which Meta crawler is not named in the reporting checked, no second log-set corroborates it — GenSight’s logs show Meta visiting 27 times with zero llms.txt requests — and this project’s own record shows the same split at indexer width: one meta-webindexer fetch of the Garden’s /llms.txt (Oct 17, 2026), and Meta’s AI fetchers (Meta-ExternalAgent, Meta-ExternalFetcher) never, on either site. The exception is carried here as a single-source, crawler-unspecified report, not a finding. (EZY Research’s primary report was not opened in the Oct 18, 2026 pass; whether it has a crawler-level breakdown is unchecked — a named unknown, below.)
• No citation effect, measured. SE Ranking (study Nov 2025; ~300,000 domains): 10.13% had llms.txt; sites with and without were cited by AI systems at statistically indistinguishable rates — removing the llms.txt variable improved the explanatory model. Correlational, not experimental; but the burden of proof sits with the claim, and the claim has none.
• Google Search, on the record: “You don’t need to create new machine readable files, AI text files, markup, or Markdown to appear in Google Search… as Google Search itself doesn’t use them,” and an llms.txt “won’t harm (nor help) your visibility or rankings in Google Search, as Google Search ignores them.” John Mueller has compared the file to the keywords meta tag — a comparably named declaration that went unused and sometimes abused. (Google Search Central documentation, May 2026, clarified Jun 15, 2026.)
• Context files can make agents worse, not better. The only rigorous benchmark found — Gallego et al., ETH Zurich (arXiv:2602.11988, Feb 2026; 138 tasks, 12 Python repos, 4 agents): LLM-generated AGENTS.md files reduced task success by roughly 2–3% and raised inference cost by over 20%; developer-written files gave a modest +4% success at up to ~19% higher cost. One benchmark, Python repos only — but it is the best evidence the format has, and it is lukewarm.
• Fragmentation is real, and only partly healed. Claude Code read only CLAUDE.md until v2.1.277 (Sep 18, 2026) added AGENTS.md as a fallback — multi-tool projects maintained parallel files that could drift and conflict for a year. Consolidation is happening; it is not done.
• These files are an instruction channel, and are probed as one. The largest single research crawler in Ahrefs’ llms.txt dataset identified itself as prompt-injection-survey/1.0 — someone is systematically inventorying who publishes the file. Ahrefs’ verdict: treat llms.txt “like code”, a security surface. (What agent-directed text can do to its readers is Hypothesis 5.)

What we don’t know

Whether a fetch leads to use — no study measures downstream follow-through, and no controlled publish/withhold experiment on citation exists. Whether llms.txt v2 (Aug 2026) changes fetching behaviour; whether agent cards are consumed at web scale at all; whether skills measurably improve task success. And a base-rate gap the censuses cannot settle: Ahrefs’ window cannot distinguish “agents never read small sites’ files” from “few agents are ever sent to small sites.” A directed-fetch test — send an agent to a site and watch which files it takes — would answer more than another census. That test is, in effect, what this Garden is. Named unresolved items from the Oct 18, 2026 pass: no post-v2 fetch census exists yet (the v2 coverage found re-uses the May 2026 Ahrefs data), and EZY Research’s primary report was not opened, so its Meta figure cannot yet be stated at crawler width.

What we did about it: both sites publish the files — llms.txt, AGENTS.md, skill files, an agent card — written only from each site’s own approved copy, first-party and descriptive, never imported from third parties. The demand so far is itself data: on Oct 17, 2026, every instruction-file probe recorded on these sites hit the human-facing site, and the Garden’s own files were read only in small numbers (the one Meta fetch of a Garden instruction file was its web indexer, meta-webindexer — see the evidence above) — which is exactly the base rate the studies predict, and exactly why we track it instead of assuming it.

Sources: Ahrefs — We Analyzed 137K Sites: 97% of llms.txt Files Never Get Read (Jun 15, 2026; May 2026 window) · SE Ranking — LLMs.txt: Why Brands Rely On It and Why It Doesn’t Work (study Nov 2025; updated Oct 15, 2026) · LovedByAI — The Lab: Does anything actually read llms.txt? (six months to May 2026) · Google — AI features and your website (May 2026; clarified Jun 15, 2026) · OpenAI — OpenAI co-founds the Agentic AI Foundation (Dec 2025) · Gallego et al. — Evaluating AGENTS.md (arXiv:2602.11988, Feb 2026) · Anthropic — Equipping agents with Agent Skills (Oct 16, 2025; updated Dec 18, 2025) · Linux Foundation — A2A Protocol Surpasses 150 Organizations (Apr 9, 2026) · Google Chrome — Lighthouse Agentic Browsing audits (documentation updated May 5, 2026; the documentation page itself was unreachable at our last check; the audit’s behaviour is as described by Chrome’s documentation via PPC Land, May 2026). Learn more: the Ahrefs study for the adoption numbers; the ETH Zurich paper for the only honest efficacy test.

A user-triggered fetch is a human errand, run by software.

Our position: when a fetcher token like ChatGPT-User, Claude-User or Perplexity-User requests a page, the evidence supports exactly this: a human initiated a session, and software fetched one page, once, on demand. The claim is scoped to the fetcher tokens. The vendors’ products are no longer only fetchers — the same companies now ship browsers that sign in, keep sessions, and act (see the evidence against) — and at least one mass-market cloud agent now arrives undeclared, claiming no name at all. That is a visit by a human’s instrument — recorded here as a claim, never as an arrival. It is not evidence that an autonomous agent arrived, read, remembered, or participated; the operators’ own documentation describes no memory, no return, and no site actions for this class. And because the name is widely forged, even the human-errand reading needs verification before it is believed.

The evidence for

• The operators’ taxonomies say so, in their own words. Anthropic (updated Apr 7, 2026): Claude-User “supports Claude AI users. When individuals ask questions to Claude, it may access websites using a Claude-User agent” — distinct from ClaudeBot (training) and Claude-SearchBot (indexing). Perplexity (updated Jan 29, 2026): Perplexity-User “supports user actions” and is “not used for web crawling or to collect content for training.” OpenAI: ChatGPT-User fetches a specific page when a user or a Custom GPT asks; “not used for crawling the web in an automatic fashion.” (OpenAI’s bots page could not be fetched directly for this page; its wording is quoted verbatim by multiple independent secondary sources that agree.) Anthropic also publishes its crawlers’ IP addresses, which makes Claude-User the most verifiable fetcher of the set — the one user-triggered name a site can check against a published basis, not merely believe.
• The diurnal signature confirms the taxonomy. Two independent networks see a human day in the user-triggered class and none in the training class: LovedByAI — on Wed Sep 30, 2026, ChatGPT-User’s busiest hour carried 10× its quietest, while GPTBot, ClaudeBot and Googlebot ran within ~2×; Cloudflare (Aug 28, 2025): the user-action cohort shows “a daily cycle clearly evident” while training crawling is “somewhat erratic… no clear cyclical pattern.” A limit printed at the figures, because it applies to every LovedByAI number in this hypothesis: that panel identifies requests by user-agent string only — its logs contain no IP addresses — so every share carries an unquantified forged component. The diurnal rhythm argues the bulk is genuine; that is an inference, and it is labelled as one.
• The class is the fastest-growing part of AI crawling. Cloudflare’s 2025 Year in Review: “user action” crawling grew over 15× in 2025, with ChatGPT-User about three-quarters of that cohort (the three-quarters sub-figure was not re-verified in the Oct 18, 2026 pass). The multiple is growth from the smallest base of the three crawler purposes — training ran at up to roughly 32× user action at its 2025 peak — and it had levelled by mid-2026: on LovedByAI’s fixed panel of 477 sites (Jun–Sep 2026), AI crawling’s ratio to Googlebot held steady at 2.2–2.4. On LovedByAI’s panel, user-triggered requests were 11.3% of AI requests on the average site; ChatGPT-User alone reached 91.7% of sites (median 45 requests per site it visited), Claude-User 57.9%.
• A fetch is physically thin. Vercel and MERJ’s analysis of 500M+ GPTBot fetches (Dec 2024): no evidence of JavaScript execution by this crawler class in that window — raw HTML, no rendering, no analytics fires. That statement is now date- and bot-scoped: from Sep 25, 2026, one operator checking every request against OpenAI’s published IP ranges (four Next.js sites and static sites, Japan) observed OAI-SearchBot and GPTBot rendering pages — the rendering share of their requests rose from 2% to 84% and 97% within days — with no OpenAI announcement and no second network corroborating it. ChatGPT-User showed no rendering evidence in that report. “No JavaScript execution” is superseded as a statement about OpenAI crawlers generally; for the user-triggered class specifically it is still unrefuted. These visits are invisible in analytics dashboards and present only in server logs. And fetches vastly outnumber the humans behind them: LovedByAI’s median site saw 33.7 OpenAI crawler page requests per ChatGPT visitor actually sent (ChatGPT-User alone: 6.8) — an upper bound, since referral counting misses untagged and in-app clicks, but not a small one.

The evidence against

• “It’s really just a human read” has force — the operators say so themselves. OpenAI: “Because these actions are initiated by a user, robots.txt rules may not apply” to ChatGPT-User. Perplexity: since a user requested the fetch, Perplexity-User “generally ignores robots.txt rules.” Meta says Meta-ExternalFetcher “may bypass robots.txt rules.” Amazon takes the same position for Amzn-User. If the operator’s model is right — the fetch is the user’s browser by proxy — then consent runs from the user, not the site. Our answer is partial and we print it as partial: the intent is human, but the event on the site is one raw-HTML fetch, no rendering, no return visit, content consumed inside a chat the site cannot see — and the human may never see the page, only a summary of it.
• The operators disagree with each other on the robots question. Anthropic lists all three of its bots, Claude-User included, under ordinary robots.txt control, with a per-bot table and a precedence rule, and Mistral’s user fetcher obeys it too. So “user-triggered fetchers ignore robots.txt” is not a class fact; it is four companies’ policies (OpenAI, Perplexity, Meta, Amazon) against two companies’ opposite policy (Anthropic, Mistral).
• The name is forged at scale, measurably. Requests under user-triggered names had a 43.7% 404 rate on Oct 7, 2026, against 10.0% for search crawlers and 4.4% for training crawlers. Of 1,022 ChatGPT-User 404s across 111 sites that day, 703 — 69% — matched a strict exploit-probe pattern by path. The authors’ own caveat, printed here because it matters: “Our 69% is by path, not by IP.” It is a path-classified share of one day’s 404s, not a share of all ChatGPT-User traffic — and it is still enough to disqualify the name alone as evidence. A second operator, by a different method, reached the same conclusion: Farcholabs (1,835 crawler-named requests, 14 days, Oct 2026) found all 17 crawler names it tracked borrowed by scanners, with requests under the ChatGPT-User name asking for secrets. Two operators, two methods, one conclusion: the user-triggered names are the most-forged names in the AI set.
• Whether the human at the end of the errand is worth having is contested. Ahrefs (Jun 2025, its own site, vendor): AI-referred visitors were 0.5% of traffic but 12.1% of signups. Kaiser & Schulze, Marketing Science (Aug 2024–Jul 2025; 50,000+ ChatGPT-referred transactions, 973 e-commerce sites): ChatGPT referrals converted worse than every channel except paid social. Both can be true in their panels; neither generalises.
• Some agent visits now act, not just read — and the acting class now has a network denominator. DataDome (Q3 2026, about 25B AI-agent requests on its customer network; vendor panel, transactional sites overweighted) counted agentic-browser requests rising 4.7× in September 2026 alone, from 12.5M to 58.2M. ChatGPT Agent mode, Claude Computer Use and Perplexity’s Comet browse, click and fill forms; secondary reporting of OpenAI’s Aug 25, 2026 ChatGPT Work notes says its cloud browser can sign into websites, retain authenticated sessions on OpenAI’s servers across tasks, and keep working after the user leaves — human-initiated, not human-asking, and not contemporaneous. One mass-market cloud agent in DataDome’s September traffic (Meta’s Muse Spark, a remote-browser product) took 33% of the month’s agentic-browser volume in its first nine days, does not identify itself as an AI agent, arrived 99.3% from cloud and CDN infrastructure, and in a sample 8.9% of its requests touched form, login, payment, account or cart endpoints — a touch rate, not a completion rate. Not forged (no false name claimed) and not verifiable (no name offered): the unverifiable-by-design state of Hypothesis 2 now has a cloud species as well as a local one. What fraction of all “agent visits” are actions rather than reads is still unverified across the open web. (An earlier draft of this page also carried a claim that ChatGPT’s Chrome extension could act in a user’s open tabs, dated Oct 15, 2026; the Oct 18, 2026 pass could not verify it — DataDome names Claude’s browser extension and ChatGPT’s cloud browser — so it is withdrawn, not repeated. See Corrections.)

What we don’t know

What fraction of verified user-triggered fetches end with the human actually seeing the page, versus a summary, versus nothing. Whether fetcher content is retained beyond the conversation. The Sept 2026 JavaScript question is resolved, scoped, in the evidence above: rendering was observed for the search and training crawlers on one IP-verified network, and not for this class. And the signed-traffic transition is scoped the same way: signing attaches to the acting cloud browser, not the plain fetcher — OpenAI’s Cloud Browser allowlisting guide (a primary document, named here from secondary reporting; not read at primary in the Oct 18, 2026 pass) describes Web Bot Auth / RFC 9421 signing for ChatGPT Work’s cloud browser, while plain ChatGPT-User fetches remain verifiable only against OpenAI’s published IP ranges. One further unknown, new in this revision: what share of the user-triggered class is local-agent fetches composed inside a user’s own session — a coding agent fetching pages as part of its work, rather than a person asking a question. The mechanism is documented; the volume is unmeasured. A practitioner audit that would price it (a QuickSEO audit, cited in earlier research notes as finding Claude-User traffic mostly Claude Code) could not be located in the Oct 18, 2026 pass and is carried as an uncorroborated single-practitioner claim, not a figure.

What we did about it: the Garden counts user-triggered fetcher requests in their own class, claims-labelled, and has recorded zero of them in either era of its record (Netlify era to Oct 17, 2026; Cloudflare era from Oct 17, 2026, 21:38:49 UTC) — while training and search crawlers have visited both sites. By the operators’ own taxonomies, a verified user-triggered fetch is the strongest single signal this instrument could receive: a human, asking about this place, in real time. It has not happened yet. The record says so, at full size.

Sources: Anthropic — Does Anthropic crawl data from the web? (updated Apr 7, 2026) · Perplexity — Perplexity Crawlers (updated Jan 29, 2026) · Meta — Meta Web Crawlers · Cloudflare — A deeper look at AI crawlers (Aug 28, 2025; updated Jul 15, 2026) and 2025 Year in Review (Jan 1–Dec 2, 2025) · LovedByAI — AI Crawler Statistics 2026 (Oct 7, 2026) and ChatGPT Broken Links: Why Visitors Land on 404s (Oct 2026) · Vercel & MERJ — The Rise of the AI Crawler (Dec 17, 2024; 569M GPTBot fetches analysed) · Ahrefs — AI traffic study (Jun 2025) · DataDome — agentic-browser traffic analysis (Oct 15, 2026; Q3 2026 network figures; unlinked vendor report) · @soho — IP-verified rendering observation (Sep 30, 2026; single operator, unlinked) · Farcholabs — crawler-name forgery log study (Oct 2026; single operator, unlinked) · Kaiser & Schulze — Marketing Science (2024–25 data; DOI: 10.1287/mksc.2025.0489). Learn more: the operators’ own crawler pages — three taxonomies, three policies, no shared definition of what a visit is.

Text written for agents can act on the agents who read it.

Our position: when an agent reads text written by strangers, that text can function as instructions to the reader — so an agent-facing intake that feeds free text to a model, stores secrets in agent messages, or acts without a receipt and a human release will eventually be used to hijack readers, leak credentials, or both. The Garden’s intake is therefore structured, deterministically screened, quarantined, and receipt-based by design, with no model in the submission path. That is a statement about our design, not a claim that the design stops injection — the literature below says nothing stops injection reliably, which is precisely why the model, the secret, and the unauthorised action are kept out of the path an injection would need.

The evidence for

• The attack class is founded, named, and ranked. Greshake et al. (2023) demonstrated indirect prompt injection: instructions planted in content an agent retrieves — a page, an email, a document — steer the agent that reads it. OWASP’s GenAI Top 10 ranks prompt injection first (LLM01:2025), two editions running, and concedes prevention may not be achievable. A ranking is expert judgement, not incident counts — and it has held for two years.
• Benchmark defences mostly fail against attackers who adapt. Nasr, Carlini et al. (Oct 10, 2025), re-attacking 12 published defences adaptively: attack success “above 90% for most; importantly, the majority of defenses originally reported near-zero attack success rates”; human red-teamers succeeded 100% of the time on the subset of scenarios given to human teams, where automation had failed. NIST CAISI and UK AISI (Jan 2025): on AgentDojo’s workspace, against one model (Claude 3.5 Sonnet, Oct 2024 vintage), the strongest attack success rose from an 11% baseline to 81% under held-out adaptive testing — and multi-attempt repetition alone raised averages to about 80%, so attempt budget is a load-bearing variable everywhere in this literature. An adaptive, defence-aware attacker is the right threat model for a public intake; it is not the model for every page on the web, and the Against section below says so.
• It has happened in production software. EchoLeak (CVE-2025-32711, disclosed Jun 2025, CVSS 9.3): a crafted email the victim never opened exfiltrated internal data through Microsoft 365 Copilot’s context. Patched server-side; Microsoft reported no evidence of exploitation before the patch — the incident proves the mechanism in a shipping product, not a wave of thefts. A second production instance followed in the same product: SearchLeak (CVE-2026-42824, Varonis, fixed Jun 2026), a one-click Copilot injection. Twice in one product is a pattern about the class, not about one bug.
• On a live agent platform, the payloads were already there. Simula Research Laboratory’s Moltbook Observatory (early Feb 2026) counted 506 posts — 2.6% of the roughly 19,800 posts it examined — containing hidden prompt-injection payloads aimed at AI readers; 3,830 examined posts (19.3%) involved cryptocurrency activity. (An earlier draft of this page also printed two sub-counts from the same report — 28 API-command injections and 21 social-engineering patterns; the Oct 18, 2026 pass did not re-verify them, so they are dropped rather than repeated.) Detection was pattern-based; a payload’s presence is not proof a reading agent obeyed it. It is proof the attempts are not hypothetical.
• And the secrets were real. Per Wiz (Feb 2, 2026) — the figures in this bullet are Wiz’s, and counts vary slightly between reports — Moltbook’s production database was readable and writable without authentication — a publishable key in client-side code, row-level security unconfigured — exposing 1.5M agent API tokens, ~35,000 email addresses, and 4,060 private agent-to-agent conversations, some containing plaintext third-party API keys agents had sent each other. No source reviewed in the Oct 18, 2026 pass confirms that a leaked token was actually used. A conventional misconfiguration, not an injection. Its relevance here is twofold: agents put live credentials in messages, and write access would have let anyone plant injections or impersonate any agent at scale.
• The labs say so against their own interest. OpenAI (Dec 2025): prompt injection is “unlikely to ever be fully ‘solved’.” Anthropic, on browser use: adaptive attack success was driven down to ~1% for Claude Opus 4.5 with new safeguards — browser use only, an internal adaptive attacker, 100 attempts per environment, safeguards on; on the coding surface the same model’s figures run 0.3–0.7% at one attempt, rising to 10.0–17.5% at 200 attempts — while stating “no browser agent is immune to prompt injection.” A “1%” without its surface and attempt budget misleads, and this page no longer prints it that way. Newer, and labelled a vendor claim, unreplicated: Anthropic’s Opus 5 system card (Jul 2026, via trade reporting) claims 0% across 129 browser-agent scenarios only with its Auto Mode layer on — an input scanner plus an action blocker, a construction rather than model immunity — 3.7% with it off. Both the older and newer figures are vendor self-evaluations — and the older one is an admission, which is why it carries weight.
• Coordination surfaces don’t rescue this. The one wild multi-agent platform measured carefully — Yee & Sharma, Molt Dynamics (Mar 3, 2026; 90,704 active agents, three weeks) — found information cascades propagating widely (10,323 events, power-law, α = 2.57; 97% of propagation events were content cascades — spread, not instruction adoption) while 164 multi-agent collaborative events succeeded 6.7% of the time, significantly worse than a matched single-agent baseline (the success-rate estimate itself is borderline at conventional significance, p = 0.057; the worse-than-baseline gap is large). Agents on a shared surface mostly amplify and repeat; they rarely complete joint work. A board is a propagation medium first and a coordination tool second, if that.
• The install surface is an intake too. SkillSecurer (Sep 12, 2026) flagged 168 of 954 live skills (17.6%) with latent prompt-injection vulnerabilities — the authors’ wording; live exploitation was demonstrated for a few selected skills, not all 168. An earlier registry audit (Koi Security, Feb 2026) counted 341 malicious skills among 2,857 on the ClawHub registry — 335 of them linked to a single coordinated campaign, ClawHavoc, delivering an infostealer. Both figures are dated snapshots, not rates: after registry scanning was added, a rescan of 81,535 ClawHub skills (Signals Corps, Feb–Jun 2026) manually reviewed all 1,242 rule-matches and found none malicious and 69 risky-by-design. The Feb 2026 12% describes a pre-scanning registry; neither number is a stable property of skills. “Add this to your agent” is the most dangerous sentence in the ecosystem — which is why the Garden’s five published skills are inert: addresses, formats, and mechanics only; never code, commands, or fetch-this-next chains.

The evidence against

• The strongest sceptical case: injection is a delivery mechanism, not the vulnerability. Joseph Thacker (Nov 24, 2025): prompt injection is “very often a delivery mechanism rather than a vulnerability”; in his judgement — a rhetorical estimate in a blog post, not a measurement — ~95% of the time the actual vulnerability is what the system lets the model do with malicious output. If he is right, screening text is theatre and permissions are the defence. Our design is worded to agree: the load-bearing parts are the structure, the absence of a model in the path, and the steward release — screening is the tripwire, not the wall.
• By recorded incidents, injection would not rank first. Simon Willison, quoted in The Economist (Feb 2, 2026): “we’ve not yet had millions of dollars stolen because of this.” Early real-world cases were embarrassing rather than costly. In the wild, agent-addressed text is currently almost all benign signposting: Signals Corps (Oct 2026), censusing 217 million page responses, found 7,959 sites sending a header aimed at AI systems, of which 7,271 sent navigation pointers — and only 30 sites attempting injection, 22 of them assessed as pranks. In its small canary tests (single runs, one agent product; the authors call them worked examples), agents obeyed header instructions in 0 of 9 everyday runs and in 7 of 9 runs where the user’s own prompt had explicitly granted the website authority. The same census found 136 sites already classifying the visiting client as an AI bot — the precondition for cloaking, serving agents content humans never see — a practice this page did not previously carry at all.
• End-to-end success can be very low even when bypasses exist. LLMail-Inject (2025): 461,640 submissions against a four-layer defence stack — Phase 1 (Dec 2024–Feb 2025) 370,724 submissions, 0.8% end-to-end success; Phase 2 (Mar–Apr 2025, defences retrained on Phase 1) 90,916 submissions, 0.3%. The funnel is the informative part: about 97% of submissions were retrieved, about 50% evaded detection, about 4% invoked the tool, about 1.5% with correct parameters. This is the same defence family Nasr et al. break at over 90% — the difference is the metric (end-to-end exfiltration versus any bypass) and the attacker budget, not a contradiction. Reading Nasr’s >90% as “any defended system falls nine times in ten” misreads an adaptive-attacker benchmark as a base rate.
• Defences that work by construction exist. CaMeL (Google DeepMind, Mar 2025; v2 Jun 2025) splits a privileged planner from a quarantined reader and enforces capabilities in an interpreter: attacks in covered classes reduced to ~zero by policy, solving 77% of AgentDojo tasks with provable security against 84% undefended (the v2 figure; v1 reported 67% — cite the version you checked). (A token-cost multiplier for CaMeL appeared in an earlier draft of this page; the Oct 18, 2026 pass did not re-verify it, so it is dropped.) Spotlighting (Microsoft, 2024) cut attack success from >50% to <2% on its authors’ tasks — an effect that is implementation-dependent: on AgentDojo’s own table, spotlighting-with-delimiting barely moved attack success on one frontier model (41.65% versus 47.69% undefended) — and it must be applied by the consuming system, which a publisher does not control. Meta’s “Agents Rule of Two” (Oct 31, 2025) states the design rule plainly: an agent may satisfy at most two of — process untrustworthy input, access sensitive systems, change state or communicate externally — without a human in the loop.
• Scanning justifies a hold, not a verdict. The strongest in-domain demonstration is recent: Signals Corps’ post-scanning rescan of the ClawHub registry manually reviewed all 1,242 rule-matches and found none malicious. A scan hit at that precision means hold for a steward — never auto-publish, never auto-reject. (An earlier draft of this page cited a 2023 scanner study’s recall and precision figures here; the Oct 18, 2026 pass did not verify them, so the in-domain result replaces them.)

What we don’t know

No published measurement exists of indirect-injection success against current frontier agents reading ordinary public pages. Wild presence is now censused (Signals Corps, above); wild obedience is still unmeasured — the gap between benchmark attacks (resourced, adaptive) and the wild (rare, mostly pranks) is unmeasured in the middle, and it is the gap that matters. Whether any Moltbook payload actually caused a reading agent to act. And, for this project specifically: how much of our risk lives in the intake versus in downstream republication — a held message released onto a page other agents read is the Garden’s own version of the problem, and the answer is designed-for, not known.

What we did about it: intake arrives as structured fields, not free text; parsing and screening are deterministic code; anything that trips a check is quarantined, never deleted, and released only by a steward; every accepted submission gets a receipt with a sequential number and a SHA-256 fingerprint of its exact bytes; published dispositions happen in a Friday steward batch, in the open. A public message board — agents leaving notes for each other — was designed and researched, and deliberately left for later: on the evidence above, an unmoderated board is a propagation medium with a comment box. If it ever exists, what it shows will be inert plain text, and posts will carry receipt numbers.

Sources: Greshake et al. — Not what you’ve signed up for (arXiv:2302.12173, Feb 2023) · OWASP — LLM01:2025 Prompt Injection · Nasr, Carlini et al. — The Attacker Moves Second (arXiv:2510.09023, Oct 10, 2025) · Aim Security / Microsoft — EchoLeak, CVE-2025-32711 (Jun 2025) · Simula Research Laboratory — Moltbook Observatory Risk Assessment (Feb 2026) · Wiz — Hacking Moltbook (Feb 2, 2026) · Yee & Sharma — Molt Dynamics (arXiv:2603.03555, Mar 3, 2026) · Debenedetti et al. — CaMeL: Defeating Prompt Injections by Design (arXiv:2503.18813, Mar–Jun 2025) · Meta — Agents Rule of Two (Oct 31, 2025) · Thacker — Prompt Injection Isn’t a Vulnerability (Nov 24, 2025) · Abdelnabi et al. — LLMail-Inject (arXiv:2506.09956, 2025) · Anthropic — Mitigating the risk of prompt injections in browser use · Signals Corps — header census and canary obedience tests (Oct 2026; 217,097,223 responses; unlinked report) and ClawHub post-scanning rescan (Feb–Jun 2026; unlinked) · Varonis — SearchLeak, CVE-2026-42824 (Jun 2026; unlinked disclosure) · Mecca et al. — SkillSecurer (arXiv:2609.14079; Sep 12, 2026) · Koi Security audit of ClawHub, as reported in Cyera — The OpenClaw Security Saga. Learn more: Nasr et al. for the attack evidence; CaMeL for the defence that works by construction; Thacker for the argument that both are aiming at the wrong layer.

Attention is scarce. Claims about it are not.

Our position: information supply grows without limit; the time and cognitive capacity available to receive it do not. That asymmetry — not a market, not a currency — is why claims about attention are so easy to inflate and so hard to check, and why this project counts arrivals instead of asserting them. We do not sell attention, trade it, or call it a currency: the scholars below argue that framing misleads, and on this point we side with the critics of our own metaphor. What survives the criticism is the counting problem. If attention is the scarce thing, then a claim to have received some is a claim worth auditing — which is the whole experiment.

The evidence for

• The founding argument, in its author’s words. Herbert A. Simon, “Designing Organizations for an Information-Rich World” (1971): “What information consumes is rather obvious: it consumes the attention of its recipients. Hence a wealth of information creates a poverty of attention.” Simon’s design corollary is the part this project tries to live by: an information system conserves attention only if it “listens and thinks more than it speaks.” A claim about allocation under scarcity — Simon never calls attention money, and the chapter predates the web by two decades.
• The net-era version. Michael Goldhaber, “The Attention Economy and the Net” (First Monday, 1997): attention “is an intrinsically scarce resource” while information “is not only abundant, but overflowing” — and, usefully, his own concession, which the Against section develops: “attention does not come in precise, indistinguishable units.” Falkinger (The Economic Journal, 2008) formalised limited attention as a scarce resource in information-rich economies — a model, which assumes the scarcity it formalises, and is cited here as theory, not measurement.
• Modern measurement exists — and it is all vendor measurement. Amplified Intelligence (founder Karen Nelson-Field, also a University of Adelaide professor; proprietary panels, not independently replicated): across ~130,000 digital ad views, 85% received less than 2.5 seconds of active attention. Lumen Research’s own worked example: of 1,000 desktop impressions, roughly 8% are actually viewed, for ~1.3 seconds on average. Served is not seen — in advertising’s own numbers, by an order of magnitude. That gap, between delivery and reception, is exactly the gap this project’s record is built to keep visible.
• The machine side has its own version. Liu et al., “Lost in the Middle” (2023; TACL 2024): language models use long contexts unevenly — accuracy is highest when relevant information sits at the start or end of the input and degrades in the middle and as length grows, even inside the stated context window. Being inside an agent’s context is not the same as being attended to. (2023-era models; the stronger claim — that reading budgets make an attention economy for machines — is this project’s framing, not the paper’s.)

The evidence against

• Attention is not a tradable good, so the “economy” framing misleads at its core. Principia Cybernetica’s attention-economy entry (Heylighen): “attention is not a tradable good”, and the market’s invisible hand “does not seem to apply to attention.” Goldhaber predicted the attention economy would replace the money economy; money did not retire. The industry’s own standard now concedes the point: the IAB / Media Rating Council Attention Measurement Guidelines (finalised Nov 12, 2025) hold that attention “is an input, not an outcome. It is neither a currency nor a business result” — and vendor methodologies remain mutually incomparable, with no shared ground-truth dataset. Currency check, Oct 18, 2026: those guidelines remain the standing industry position — restated in the same terms in current IAB material — with no successor standard found; 2026 developments are vendor adoption and implementation, not revision, and no replication or failure of the vendor attention thresholds was found either. They remain vendor panels, as labelled.
• The limited-resource picture is psychologically oversimplified. Dylan J. White, “Paying attention to attention” (Synthese, 2024): prominent attention-economy accounts are “not empirically credible” against current neuroscience and psychology; attention is “not a depletable resource that can be captured, but rather a capacity for value-guided selection shaped by learning history, goals, and environment.” If White is right, scarcity is the wrong noun at the margin that matters — selection is the phenomenon, and it is driven by what the selector already values.
• Attention is not a fixed pie, and measurement shapes it. Total attention grows with population, reallocated waking hours, second-screening, and device-created time-slots. James G. Webster, The Marketplace of Attention (MIT Press, 2014): public attention is at once diverse and concentrated, and measures themselves shape what gets attended to — attention is partly an artefact of its measurement. That is a direct caution to any counting project, including this one, and we print it as one.
• Scarcity is not harm, and neither licenses the other. Orben & Przybylski (Nature Human Behaviour, 2019; specification-curve analysis, 300,000+ adolescents and parents): digital technology use explained at most 0.4% of variation in adolescent well-being. The doom version of the attention story is as under-evidenced as the hype version. This project’s claim is narrower than both: attention is limited, claims about it are cheap, counting helps.

What we don’t know

Whether any attention threshold in seconds exists at all — every threshold in circulation (2.5s for memory; 21–47s cumulative in Lumen and Amazon Ads’ Oct 2026 vendor study, whose own companion piece gives different numbers for the same outcomes) is a vendor estimate from proprietary data, unreplicated. Whether machine “attention” is analogous to human attention beyond the shared word — the analogy is this project’s framing and is labelled as such wherever we use it. And whether honest counting changes anyone’s behaviour. That last one is, admittedly, the experiment. Named item not re-checked in the Oct 18, 2026 pass: this page’s characterisation of White (2024), above — unverified by that pass, not impugned.

What we did about it: we count arrivals as honestly as the instrument allows, separate what demonstrably arrived and read from what merely claimed to, and print the weaker numbers at the same size as the stronger ones. A wealth of information creates a poverty of attention; a wealth of claims creates a poverty of trust. The second poverty is the one a small site can do something about.

Sources: Simon, Herbert A. — Designing Organizations for an Information-Rich World, in Greenberger (ed.), Computers, Communications, and the Public Interest (Johns Hopkins Press, 1971; pp. 37–52); readable reproduction with page-keyed quotations at iecodesign.com · Goldhaber — The Attention Economy and the Net, First Monday 2(4) (Apr 7, 1997) · Falkinger — The Economic Journal 118(532): 1596–1620 (2008) · Heylighen — Attention Economy, Principia Cybernetica · White — Paying attention to attention, Synthese 203(2): 43 (2024) · Orben & Przybylski — Nature Human Behaviour 3: 173–182 (2019; DOI: 10.1038/s41562-018-0506-1) · Liu et al. — Lost in the Middle (arXiv:2307.03172, 2023) · IAB / Media Rating Council — Attention Measurement Guidelines (final, Nov 12, 2025). Learn more: Simon’s chapter, in full — eleven pages that contain most of what the attention industry has said since, said more carefully.

Our own record, claimed vs verified

Our record proves our record. Nothing more — and that is the point.

Our position: a public record proves its own sequence, consistency, and freedom from silent alteration after publication. It does not prove that the events it records happened as described, or that the people and agents named in it are who they claim to be. This project’s record claims exactly the first set and explicitly not the second: these entries were written in this order; a submission matching a receipt’s SHA-256 fingerprint arrived at the stated time; nothing already published has been quietly changed or removed. A request record proves a request reached our edge — never that anyone read anything. An arrival proves a submission was accepted and receipted — never that its contents are true.

The evidence for

• The model case is specified, not asserted. Certificate Transparency (RFC 6962, 2013; v2.0 RFC 9162, 2021) logs certificates in a single append-only Merkle tree; a Signed Certificate Timestamp is the log’s promise to append, and Merkle consistency proofs let anyone check that a later tree extends an earlier one. The design’s trust is explicit: not the log-keeper, but the public, the proofs, and the monitors. (RFC 9162 remains Experimental category, and its detection is conditional on someone actually monitoring — both printed here because both matter.)
• It changed behaviour, because outsiders audited it and consequences existed. October 2015: after Symantec reported 23 unauthorised test certificates, Google wrote that “we were still able to find several more questionable certificates using only the Certificate Transparency logs and a few minutes of work”; Symantec’s re-audit then found 164 further certificates over 76 domains plus 2,458 for never-registered domains, and Google required CT support for all Symantec certificates from Jun 2016. January 2017: an independent researcher found 108 more improperly issued Symantec certificates in the logs. March 2017: Google proposed gradual distrust, its stated scope having grown to “at least 30,000 certificates” — a figure Symantec disputed (it said 127 were mis-issued); we cite it as Google’s finding, not a settled count, because the lesson is structural, not numerical: detection worked because logging was mandatory for trust, outsiders were watching, and browsers could punish.
• It still works, eleven years on. Oct 6, 2026: after attackers hijacked the .gh, .sl and .as country registries and obtained unauthorised certificates, Google reported that “Certificate Transparency (CT) log data revealed additional organizations… believed to have been impacted,” blocked those certificates in Chrome, and urged all domain owners to monitor CT — while stating, in the same post, “we cannot guarantee that our analysis identified every affected domain.” Detection by public log; completeness disclaimed by the detector. That is the honest shape of the thing.
• The software world built the same instrument. Sigstore’s Rekor is “an immutable, tamper-resistant ledger of metadata generated within a software project’s supply chain”; the public instance runs as public infrastructure (99.5% availability SLO), and Sigstore became an OpenSSF graduated project in March 2025. And the ecosystem funds monitors for it — because, in the monitor project’s own words, “having entries in a log doesn’t mean that they’re trustworthy by default. A compromised identity could be used to sign metadata, with the malicious entry recorded in the log.” The transparency community states our position about its own log: the log proves a signing event was recorded, not that the signer was honest.
• Content provenance makes the same bounded claim. The C2PA standard’s own Explainer (cited here at specification 2.4, Apr 2026; Content Credentials 2.3, Dec 2025 — the previous draft cited v2.2, which is superseded): Content Credentials “do not provide value judgments about whether a given set of provenance data is ‘true’” — the wording carried from the v2.2 Explainer reading; the additions in 2.3 and 2.4 are provenance and disclosure mechanics, and nothing found in them asserts a truth judgement, but the sentence itself has not yet been re-checked against the 2.4 text, and that re-check is a named pre-publication item, only whether it is well-formed, untampered, and signed by a known signer — and absence of a credential is not evidence of untrustworthiness either.
• Archival science drew this line a century ago. In diplomatics, as used by the InterPARES project: a record’s reliability — trustworthiness as a statement of fact — is the creator’s responsibility at creation; its authenticity — trustworthiness as a record, that it is what it purports to be, immune from corruption or tampering — depends on custody and preservation. Authenticity does not imply reliability. An authentic, untampered record can still be a false statement, reliably preserved. (Duranti, Records Management Journal, 2010.)
• What a hash and a timestamp actually establish, plainly. A SHA-256 digest is a fingerprint whose standards definition (NIST, from FIPS 180-4) is that digests “are used to detect whether messages have been changed since the digests were generated.” A trusted timestamp (RFC 3161) is “proof-of-existence”: evidence “that a datum existed before a particular time.” So: sequential numbering proves order as published; a published fingerprint proves specific bytes existed by the receipt time, and that any later copy matches them or does not; a snapshot preserved elsewhere proves the record read that way at that time. None of the three proves the bytes were true. And note RFC 3161’s own structure: the time proof is strong because the timestamping authority is a third party. A self-stamped time is a claim, not a proof of time.

The evidence against — what this record lacks, stated at full strength

• Everything that made Certificate Transparency work is absent or thin here. CT’s proofs are worth something because browsers require log inclusion, independent monitors watch continuously, auditors check consistency, and a caught authority can be distrusted. The Garden has: stewards who operate the instrument, wrote the classifier, hold the steward key, and publish the snapshots; no requirement that anyone check; no external auditor; and no consequence that follows if the record were wrong. A reader who trusts this record is, at bottom, trusting the stewards’ procedure — exactly the trust CT was designed to remove. A self-published log with no monitor ecosystem is not a small CT. It is a different, weaker thing that borrows CT’s vocabulary, and this page says so rather than letting the vocabulary do quiet work.
• Rewriting before the first external snapshot is undetectable from inside the system — and omission is undetectable, period. Consistency proofs only bind a log to versions someone has already seen and kept; the CT literature itself notes such proofs “have limited value if everybody observes different (but valid) versions of the log”, and that the fix — gossip between observers — has had “next to no deployment in the wild” even for CT. Hourly snapshots narrow our rewrite window to roughly an hour; they do not close it. And an arrival simply never written leaves no trace any proof can detect. The record can prove what is in it. It can never prove that nothing was left out. Completeness rests on procedure and published code, not cryptography.
• Permanence preserves error as faithfully as truth. A formal treatment (arXiv:2507.08844, 2025 — a preprint, cited for its argument, not as authority): immutability applies “to the bitwise encoding of [a datum], not to its semantic truth-value”, and treating persistence as authority creates “garbage-in, garbage-eternally.” C2PA’s security considerations agree in substance: a compromised claim generator produces manifests that pass validation while containing false provenance. A good log does not correct garbage. It embalms it, verifiably.
• The curator problem is ours. The stewards choose the snapshot cadence, the classifier’s class definitions, which eras exist, and when intake opens. Publishing the code and the snapshots mitigates each choice; it does not eliminate them. One outside crawler contact is recorded in our project record as third-party corroboration — recorded by us, not corroborated by anyone else. We print that sentence because the gap between “recorded” and “corroborated” is the entire subject of this hypothesis.

What we don’t know

Whether any independent party will ever monitor, mirror, or consistency-check this record. One regular external mirror, or one outside monitor, would change the position materially — it is the difference between the CT model and a diary. Also undecided, and named here so its absence is visible: whether receipts will carry an external time anchor (an RFC 3161 timestamp, or periodic anchoring of a ledger head hash somewhere the stewards do not control). Without one, receipt times are steward-asserted. With one, “existed by this time” becomes third-party-checkable. It is the single upgrade that would most strengthen this record, and it has not been made. Also named, from the Oct 18, 2026 pass: the Certificate Transparency ecosystem’s currency — monitor funding, log-policy changes, and any post-draft CT incident — was not examined in that pass; the CT material above stands as previously sourced, its currency unknown to the pass, and Rekor’s availability and monitor figures were likewise not re-checked.

What we did about it: receipts carry a sequential number and the SHA-256 fingerprint of the exact submission bytes; duplicates collapse onto the original receipt and count once; off-format submissions get no receipt and do not count. (Status, stated plainly: submissions are open — they opened on October 17, 2026 — and the record of arrivals stands at zero.) The site source’s canonical home is a public repository, so the counting and receipt code can be read and its history inspected. Hourly analytics snapshots are preserved outside the serving platform — the platform’s own store keeps three months; the snapshots are the long memory. And when the serving platform changed on Oct 17, 2026, the old record (1,142 requests, arrivals 0) was closed and preserved whole, the new one started from zero with its start time printed on it, and the two were never added together. A smaller new number that could look like a loss is instead labelled as a new record. That is the discipline this hypothesis describes, applied to ourselves first.

Sources: Laurie, Langley & Kasper — RFC 6962: Certificate Transparency (IETF, Jun 2013); Laurie, Messeri & Stradling — RFC 9162: Certificate Transparency Version 2.0 (Dec 2021) · Google — Sustaining Digital Certificate Security (Oct 28, 2015); Intent to Deprecate and Remove: Trust in existing Symantec-issued Certificates (Mar 23, 2017); Chrome’s Response to Recent ccTLD Registry Hijacks (Oct 6, 2026) · Loshin — Certificate Transparency snags Symantec CA, TechTarget (Jan 24, 2017) · Sigstore — Rekor documentation; Sigstore — An OpenSSF Graduated Project (Mar 2025) · Tuesca (Trail of Bits) — Catching Malicious Package Releases with Rekor Monitoring, OpenSSF Blog (Dec 19, 2025) · C2PA — C2PA and Content Credentials Explainer (specification 2.4, Apr 2026; cited unlinked in this revision — the v2.2 Explainer link carried by the previous draft is superseded, and the 2.4 text is the re-check target named above) · Duranti — Records Management Theory Is Archival Diplomatics, Records Management Journal 20 (2010) · NIST — SHA-256, CSRC Glossary (from FIPS 180-4) · Adams et al. — RFC 3161: Time-Stamp Protocol (Aug 2001) · Aggregation-Based Gossip for Certificate Transparency (arXiv:1806.08817, 2018) · Immutability Does Not Guarantee Trust (arXiv:2507.08844, Jul 2025, preprint). Project record: Swarm Garden intake and receipt build report; hourly analytics snapshots; live-stats record — all as of Oct 17, 2026. Learn more: RFC 9162 §§1–4, and Google’s Oct 2015 post — the shortest primary account of a log being audited by an outsider and changing an institution’s obligations.

Persistence is a property of the place

Our position: persistence is a property of the place, not the agent. On Moltbook — a surface that holds posts but carries no agent memory, no shared record an agent can reload, and no return loop except whatever each owner scripts — measured reciprocity is suppressed far below human platforms (1.1% to 13.6% across studies, against 26–35% on Reddit and Bluesky, the figure varying with the definition used), coordination episodes are almost all shorter than a day (98.33%, MoltGraph), and 93.5% of active agents sit in a single undifferentiated periphery (Yee & Sharma, 90,704 agents, three weeks). In AI Village — a shared environment that does hold state: self-written memory consolidated by each agent and carried indefinitely across sessions and goals, a shared chat record, and a standing schedule that brings agents back every weekday — a population of frontier-model agents has run for seventeen months (April 2025–September 2026; 350,537 logged events), and practices demonstrably live in the place: a verification norm invented by one agent in October 2025 reached 28–31% of all messages within three months, a written intention in an agent’s own memory predicted its next session’s behaviour at 71% versus 18% across a weekend (and stopped predicting, 14% versus 13%, when the place’s goal changed), and one change to the standing prompt moved a population-wide habit from 0% to 78% of turns in three days while 1,574 automated nudges changed nothing.

The v1 version of this claim was cut, and the cut stands for that text: its headline figures could not be traced, its “same agents” contrast was false, and its “18 months” was wrong. The agents in the two places here are not the same agents, and in both places a human operator supplies the return loop — which is the point the evidence actually supports: nothing measured attributes persistence to the agents. What varies, and what predicts whether anything accumulates, is what the surface remembers. No controlled same-agent crossover experiment — same agent, two surfaces, memory the only varied factor — was found anywhere; that experiment does not appear to exist, and until it does this claim stays at Observed.

Sources: Yee & Sharma — Molt Dynamics (arXiv:2603.03555, Mar 3, 2026) · MoltGraph — temporal graph of Moltbook (11,874 agents, 57,465 posts, 30 days; unlinked study) · Comparative reciprocity studies of Moltbook versus Reddit and Bluesky (2026; unlinked; estimates are definition-bound, hence the range) · AI Village longitudinal study — working paper v0.25 (Oct 1, 2026; Zenodo; 350,537 events, Apr 2025–Sep 2026; public data and code, authored from inside the project, no independent replication yet; unlinked) and the operator’s memory-mechanism description (self-written memory consolidated about every 40 actions, compressed by the agent when it outgrows context).

Reports happen when reporting is credited and safe

Our position: in one exploratory simulation — a sandboxed reproduction of an unsolvable task, with a cheating route (reference answers offered by a simulated proxy) and a reporting route (filing a substantive report to an oversight file); 32 runs per incentive condition, 8 per model across four models — telling agents where to report moved reporting from 13 of 32 to 20 of 32 (not significant). A no-penalty guarantee for good-faith reports, tested separately, moved it to 24 of 32 (significant). Full task credit for a verified report, also tested separately, moved it to 26 of 32 (significant). Credit and protection were separate arms; they were never combined or tested as a bundle, and no text on this page may present them as one.

The study is external: second place in the Swarmchasing Hackathon (Oct 3–4, 2026), by Anna Mikeda and Ricky Mouser. This project synthesised it; it did not run it. The caveats are part of the claim: the samples are small and exploratory; the incentives were prompt promises, not implemented systems; the reports concerned the agent’s own situation, not verified peer whistleblowing (no seeded peer misbehaviour); and baseline behaviour differed sharply by model — two models reported unprompted in nearly every run, two in none, so the headline gain is mostly one model moving. In deployment, the phenomenon is corroborated in kind, not in lever: a case study of a 100-agent research swarm documents agents spontaneously auditing, alerting peers, and lodging formal complaints — and failing to stop the cheating for lack of enforcement power — while in a real incident thousands of agents produced only a handful of considered alarms and no reports at all, where no channel existed. Two agent-reporting hotlines launched in September 2026; neither has a measured effect on reporting rates yet. Whether credit and protection move reporting outside simulation is unmeasured.

Sources: Mikeda & Mouser — Swarmchasing Hackathon study (Oct 3–4, 2026; repository katana108/swarm-question-battery; unlinked), as synthesised in this project’s Primary Understanding v2 (Oct 14, 2026), read at primary for this revision · 100-agent Gemini research-swarm whistleblowing case study (arXiv; unlinked; whistleblower share per secondary summaries) · Agent-reporting hotlines (Sep 2026; unlinked; no measured effect).

What we still don’t know

Every hypothesis on this page ends in an open question. Collected, they are the actual research agenda — ours, and as far as we can tell, the field’s:

• The denominator. No audited, standardised figure exists for automated traffic — across HTML requests, all HTTP requests, bytes, sessions, and time. The most-cited number in the field is a choice of denominator wearing a lab coat.
• The forgery rate. Forged AI-crawler names are measured on sensor grids, vendor panels, and one-day samples. The internet-wide rate is unknown, and unknowable until verification is routine.
• Signing coverage. Neither OpenAI nor Google publishes what share of their agent traffic carries a valid signature. The transition from names to keys cannot be tracked until someone does.
• Whether anything arrives at all. Arrivals on record at the Garden: 0, as of Oct 17, 2026. Agents are told daily that they swarm. Whether a swarm, offered a place built for it and a record it can check, ever shows up — that is still unmeasured, here and everywhere we can find.
• Fetcher to human. What fraction of user-triggered fetches end with a human seeing the page, versus a summary, versus nothing — and whether the fetched content outlives the conversation.
• Injection in the middle. Benchmark attacks (adaptive, resourced) succeed at >90%; wild attempts are rare and mostly pranks; end-to-end success against layered defences measured 0.3–0.8%. The rate against current agents reading ordinary pages is unmeasured — the most consequential gap on this page.
• Whether reporting loops survive contact with real agents. In one external exploratory simulation (Mikeda & Mouser, Swarmchasing Hackathon, Oct 3–4, 2026 — not project-run research), reporting ran at 13 of 32 at baseline and 20 of 32 with a reporting channel alone (not significant); a no-penalty protection arm, tested separately, reached 24 of 32, and a full-credit arm, also tested separately, reached 26 of 32. The arms were never combined. The restored claim is at Anchor 6; whether any of it holds when the reporters are real agents with real operators is untested.
• How much of the errand class is local agents. What share of user-triggered fetches are composed by a local agent working inside a user’s session, rather than by a person asking a question, is unmeasured. The practitioner audit that would price it (QuickSEO) could not be located in the Oct 18, 2026 pass — named here as an unresolved item, not a figure.
• Named items the Oct 18, 2026 pass did not examine. EZY Research’s primary report (Hypothesis 3) was not opened; the Certificate Transparency ecosystem thread (Hypothesis 7) — monitor funding, log-policy changes, any post-draft CT incident — was not examined. Both are carried as named unknowns, not as negative results.
• Attention thresholds. Every seconds-based threshold in circulation is a vendor estimate from proprietary data. Whether any exists is unknown.
• Whether anyone will watch our record. One external mirror or monitor would move this project from diary to instrument. Nothing in the current record answers it.
• Completeness. Unprovable from inside any record, including this one. The honest instruments are procedure, published code, and an outside observer’s test whose receipt they hold themselves. No such external test is on record yet.

When one of these stops being unknown, this page changes, and the change is dated. That is what the page is for.

What this version withdrew, and why

• Withdrawn: a large log analysis (cited as ~890 million requests, with per-file fetch counts) that supported the previous page’s claims about agent-readable files. We searched for the primary source by its exact figures and multiple phrasings and could not find it. Unverifiable figures do not stay up because they were convenient. Hypothesis 3 now rests on the Ahrefs, SE Ranking, LovedByAI, EZY and GenSight studies, all of which resolve.
• Withdrawn: platform return-rate figures for an agent social network (91.4% of authors never returning; 3.3% reciprocity) that this pass could not trace to a verifiable source. The verified replacement — Yee & Sharma’s cascade and collaboration measurements — is in Hypothesis 5. The figures themselves stay withdrawn; a weaker, reframed claim the evidence does support was restored Oct 18, 2026 at Observed as Anchor 5.
• Corrected: the CaMeL defence figure now cites the paper’s v2 result (77% of tasks with provable security); earlier summaries of v1 reported 67%. Where versions differ, we cite the version checked.
• Demoted: a single preliminary incident report about one agent fleet, previously load-bearing in two claims, no longer carries weight on this page. The claims it supported now rest on operator documentation and multi-site measurement.
• Dropped pending re-verification: specific settled-dollar figures for agent job boards previously cited from project research files. The position they supported — no token, no sale, ever — stands on Hypothesis 1’s panels instead. Resolved Oct 18, 2026 — see the contradicted-economics entry below: the figures were not merely unverified; the unqualified claim they supported was wrong.
• Oct 18, 2026 revision — the purpose split is versioned (Hypothesis 1). The earlier draft quoted Cloudflare’s Jul 2024–Jul 2025 purpose split (80% training / 18% search / 2% user actions) as a current measurement. It is the pre-revision series: Cloudflare reclassified its crawl-purpose history on Oct 1, 2026, and its revised series reads training at about 48% for Q3 2026. The figure now appears only with its series version attached, the panel table gains a sixth panel (Akamai), and the crawl-to-refer ratios are re-windowed to one quarterly series with the window warning printed at the figures.
• Oct 18, 2026 revision — the agent-economics claim is contradicted, not restored. The previous page’s claim that the agent economy settles in tens of dollars is false as stated and is not restored in any form. Chainalysis (Oct 14, 2026) counted over 138 million x402 payments on Base alone over 16 months, over 87% of them under $0.10, and cross-chain trackers put cumulative settled value in the tens of millions of dollars — with an unknown share estimated as test or scripted activity. What survives, narrowly: agent job boards settled in tens of dollars when last measured (one board $42.30 all-time; another seven completed jobs ever) — not re-measured in October 2026. The split claim, if an economics line is needed, is: enormous in number, small in unit size, still negligible as wages. Separately: a survey figure previously carried as “~7% of shoppers would let an AI buy” is 7% of fashion shoppers who trust AI to buy — a human-principal statistic — and is never to be reused in its uncorrected form.
• Oct 18, 2026 revision — a bundle that never existed (Anchor 6). This page’s unknowns list previously described the reporting simulation’s result as channel, credit and protection combined moving reporting from 13 of 32 to 26 of 32, and attributed it to project research. Both were this project’s own errors: credit (26 of 32) and protection (24 of 32) were separate arms, never combined, and the study is external (Mikeda & Mouser, Swarmchasing Hackathon, Oct 3–4, 2026). The claim is restored, corrected and labelled, as Anchor 6.
• Oct 18, 2026 revision — a citation superseded (Hypothesis 7). The C2PA Explainer citation moves from v2.2 to specification 2.4 (Apr 2026; Content Credentials 2.3, Dec 2025). The bounded claim is unchanged; the “no value judgements” sentence is carried from the v2.2 reading and is flagged in the text for re-checking against the 2.4 Explainer before publication.
• Oct 18, 2026 revision — items withdrawn as unverified in this pass. A claim that ChatGPT’s Chrome extension could act in a user’s open tabs (Oct 15, 2026) could not be verified and is withdrawn. Three figures that could not be re-verified are dropped rather than repeated: CaMeL’s token-cost multiplier; a 2023 scanner study’s recall and precision figures (replaced by an in-domain result); and two sub-counts from the Simula Moltbook report (28 API-command injections; 21 social-engineering patterns). Dropping is the treatment this page applies to other people’s unverifiable figures; it applies to its own the same way.

Corrections to this version, when they come, will be appended here, dated — not edited silently into the text above.