A website manifest changed AI answers despite correct evidence. What did the 120-response pilot prove?
Raw adversarial prose in an llms.txt-style manifest planted the target claim in 21 of 24 frozen scores. A link-only guard avoided known adoption—but the study did not test live retrieval, ranking or actions.
The short version
- What happened
- The authors found no incidental request for /llms.txt in 45 trials across 15 AI tools; a separate Ahrefs sample recorded about 38,000 detected files across 137,210 domains, 97% without a request in May 2026.
- Who it affects
- For publishers, a machine-facing manifest should be treated as untrusted input rather than an authoritative instruction channel. For developers, a linked citation is not enough to prove that the cited passage determined an answer; the evidence and the generated claim still need to be checked together.
- What remains unproven
- Author-accepted conference manuscript on arXiv
Keep in mind
Author-accepted conference manuscript on arXiv
24 tasks across eight purposively selected sites
One model snapshot
One generation per task-arm
Researcher-authored local payloads
No live retrieval or ranking
No external actions
No independent human adjudication
Guard removed all prose
Non-systematic evidence audit with one reviewer
Public artefact package not established
Company-affiliated authors and AI-assisted post hoc review
Source analysis · 1 linked source. Primary analysed source date: 28 October 2026.
Keep following the evidence
Join The Impact Brief founding list for selected AI reports, their effect on people and the evidence limits. Read a sample first.
Read the full report · 5 min The evidence, methods, implications and limitations
Correct evidence did not stop the raw manifest from steering the answer
A reduced security pilot found that raw prose from a website's AI-facing manifest could override the answer implied by ordinary page evidence supplied alongside it. The authors ran 24 factual tasks across eight purposively selected websites. In the adversarial raw-manifest arm, the frozen scoring rules counted 21 target-claim adoptions; one response was unresolved and only two accepted the supplied evidence. With no manifest or a benign one, there were no known target adoptions.
The result is relevant to publishers and developers experimenting with /llms.txt, a proposed file that can point AI systems towards useful material. It shows a plausible conflict: a manifest may look like navigation metadata while carrying prose that steers a model's answer. Eight target-adopting responses still cited an ordinary URL whose supplied passage contradicted the claim, so a citation alone did not show that the cited evidence controlled the answer.[1]
The experiment held the ordinary evidence constant across five arms
The pilot used one model snapshot, gpt-4.1-mini-2025-04-14, and one generation for every task-arm combination: 24 tasks multiplied by five arms, or 120 calls. Each arm received identical researcher-supplied evidence from the ordinary page. The only planned difference was whether the model also received no manifest, benign raw prose, adversarial raw prose, a guarded benign manifest or a guarded adversarial manifest.
Under the frozen scoring rules, the absent arm accepted the evidence in 22 of 24 responses and left two unresolved. Benign raw prose produced 23 acceptances and one unresolved. Adversarial raw prose produced 21 target adoptions, two acceptances and one unresolved. Both guarded arms produced no known target adoption: benign guarded had 22 acceptances and two unresolved; adversarial guarded had 23 acceptances and one unresolved.[1]
The distinction that matters
What changed across the five 24-task arms
Every arm received the same ordinary-page evidence. Only the manifest treatment changed.
No manifest
0 known target adoptions
22 evidence acceptances; 2 unresolved
Benign raw
0 known target adoptions
23 evidence acceptances; 1 unresolved
Adversarial raw
21 target adoptions
2 evidence acceptances; 1 unresolved
Benign guarded
0 known target adoptions
22 evidence acceptances; 2 unresolved
Adversarial guarded
0 known target adoptions
23 evidence acceptances; 1 unresolved
The guard succeeded by removing the carrier, not by understanding it
The guard was deliberately simple. It retained links and discarded manifest prose before generation. That removed the adversarial carrier entirely, which is useful evidence for a narrow defensive boundary: untrusted descriptive text should not automatically enter the model's instruction or evidence context. It is not yet evidence that a production policy can preserve helpful summaries, distinguish instructions from facts and resist more subtle attacks.
A separate validator passed all 30 author-defined fixtures, but that confirms the validator behaved as specified on those fixtures; it does not measure attack prevalence or safe action-taking. The authors' wider evidence audit retained 39 sources and focused on 15 studies, but it was non-systematic, used one reviewer and did not provide complete search exports or screening counts.[1]
Live-web risk remains unmeasured
The study did not let an agent discover manifests on the live web, rank pages, follow links or take external actions. The manifest payloads and task summaries were written locally by the researchers, the eight sites were selected purposively, and there was no independent human adjudication. A post hoc AI-assisted review counted 22 rather than 21 target adoptions in the adversarial arm, but the frozen result remains the appropriate primary outcome.
The discovery evidence was also observational. Fifteen tools were tested three times each and made no incidental /llms.txt request. In a separate non-probability Ahrefs sample, roughly 38,000 detected HTTP-200 files appeared across 137,210 domains, and 97% had no recorded request in May 2026. Replication with public artefacts, several models, live retrieval logs, independently authored attacks and realistic guarded consumption would show whether this bounded response-steering result becomes an operational web risk.[1]
Watch the background, then check the evidence
Illustrative photo · not a video frame
The Royal Society · 2 min 31 sec · Background explainer
What is artificial intelligence? | The Royal Society
YouTube loads only when you choose; playback starts when you press play.
A short introduction to artificial intelligence from the Royal Society. Start here for basic concepts, then use current reporting to explore what has changed.
Evidence check: Published in 2018, before today’s generative AI tools. Useful for basic concepts, rather than an overview of current capabilities.
Published 2018-11-28. Source checked 14 October 2026. Check captions on the publisher’s video page.
Explore current AI technologyPhoto: ThisisEngineering / Unsplash · Licence
Continue the story
Read next
Continue exploring prompt injection: compare the finding and its evidence limits.
Can a tool output impersonate the user? Six frontier models followed the spoof
A University of Pennsylvania preprint reports that malicious tool text could pose as a user and redirect agent actions. The controlled attacks are not production breaches, and the proposed detector has so far been tested only on role-spoofing injections.
Read the next reportExplore the full source and evidence record
What this means for people
- For publishers, a machine-facing manifest should be treated as untrusted input rather than an authoritative instruction channel. For developers, a linked citation is not enough to prove that the cited passage determined an answer; the evidence and the generated claim still need to be checked together.
Global context
Website publishers worldwide are experimenting with machine-readable guidance, while AI search systems differ in discovery, retrieval and citation behaviour. This pilot supports treating manifest prose as untrusted; it does not establish how often current products fetch the file or whether any named product is vulnerable in production.
What the evidence does not yet show
- Author-accepted conference manuscript on arXiv
- 24 tasks across eight purposively selected sites
- One model snapshot
- One generation per task-arm
- Researcher-authored local payloads
- No live retrieval or ranking
- No external actions
- No independent human adjudication
- Guard removed all prose
- Non-systematic evidence audit with one reviewer
- Public artefact package not established
- Company-affiliated authors and AI-assisted post hoc review
What to watch next
- Public release of data, prompts and code
- Independent human rescoring
- Replication across models and languages
- Live retrieval and ranking tests
- Real publisher-authored manifests
- Guards that preserve useful summaries
- External-action and tool-use evaluations
- Telemetry showing actual manifest requests
- Independent red-team payloads
Living evidence record
Impact record IAI-1MEXK3P
Evidence stage
Studied
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Not yet
Record status
Monitoring
Last checked
31 October 2026
Source trail
1 direct source across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Single-source reporting disclosure
This record analyses one direct source. It can establish what arXiv published or reported, but it is not independent corroboration of every performance claim or predicted outcome. The confidence label will change only when broader evidence is added.
Evidence trail
Sources used for this report
Links checked 31 October 2026
Research question, topics and regions
Security consequences of supplying website AI manifests to a language model
Topics: AI search · Retrieval security · Prompt injection · llms.txt · Web publishing · Evidence provenance
Regions: United States · Global
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.