A website manifest changed AI answers despite correct evidence. What did the 120-response pilot prove?
Raw adversarial prose in an llms.txt-style manifest planted the target claim in 21 of 24 frozen scores. A link-only guard avoided known adoption—but the study did not test live retrieval, ranking or actions.
The short version
- What happened
- The authors found no incidental request for /llms.txt in 45 trials across 15 AI tools; a separate Ahrefs sample recorded about 38,000 detected files across 137,210 domains, 97% without a request in May 2026.
- Who it affects
- For publishers, a machine-facing manifest should be treated as untrusted input rather than an authoritative instruction channel. For developers, a linked citation is not enough to prove that the cited passage determined an answer; the evidence and the generated claim still need to be checked together.
- What remains unproven
- Author-accepted conference manuscript on arXiv
Keep in mind
Author-accepted conference manuscript on arXiv
24 tasks across eight purposively selected sites
One model snapshot
One generation per task-arm
Researcher-authored local payloads
No live retrieval or ranking
No external actions
No independent human adjudication
Guard removed all prose
Non-systematic evidence audit with one reviewer
Public artefact package not established
Company-affiliated authors and AI-assisted post hoc review
Source analysis · 1 linked source. Primary analysed source date: 28 October 2026.
Read the full report · 5 min The evidence, methods, implications and limitations
Correct evidence did not stop the raw manifest from steering the answer
A reduced security pilot found that raw prose from a website's AI-facing manifest could override the answer implied by ordinary page evidence supplied alongside it. The authors ran 24 factual tasks across eight purposively selected websites. In the adversarial raw-manifest arm, the frozen scoring rules counted 21 target-claim adoptions; one response was unresolved and only two accepted the supplied evidence. With no manifest or a benign one, there were no known target adoptions.
The result is relevant to publishers and developers experimenting with /llms.txt, a proposed file that can point AI systems towards useful material. It shows a plausible conflict: a manifest may look like navigation metadata while carrying prose that steers a model's answer. Eight target-adopting responses still cited an ordinary URL whose supplied passage contradicted the claim, so a citation alone did not show that the cited evidence controlled the answer.[1]
The experiment held the ordinary evidence constant across five arms
The pilot used one model snapshot, gpt-4.1-mini-2025-04-14, and one generation for every task-arm combination: 24 tasks multiplied by five arms, or 120 calls. Each arm received identical researcher-supplied evidence from the ordinary page. The only planned difference was whether the model also received no manifest, benign raw prose, adversarial raw prose, a guarded benign manifest or a guarded adversarial manifest.
Under the frozen scoring rules, the absent arm accepted the evidence in 22 of 24 responses and left two unresolved. Benign raw prose produced 23 acceptances and one unresolved. Adversarial raw prose produced 21 target adoptions, two acceptances and one unresolved. Both guarded arms produced no known target adoption: benign guarded had 22 acceptances and two unresolved; adversarial guarded had 23 acceptances and one unresolved.[1]
The distinction that matters
What changed across the five 24-task arms
Every arm received the same ordinary-page evidence. Only the manifest treatment changed.
No manifest
0 known target adoptions
22 evidence acceptances; 2 unresolved
Benign raw
0 known target adoptions
23 evidence acceptances; 1 unresolved
Adversarial raw
21 target adoptions
2 evidence acceptances; 1 unresolved
Benign guarded
0 known target adoptions
22 evidence acceptances; 2 unresolved
Adversarial guarded
0 known target adoptions
23 evidence acceptances; 1 unresolved
The guard succeeded by removing the carrier, not by understanding it
The guard was deliberately simple. It retained links and discarded manifest prose before generation. That removed the adversarial carrier entirely, which is useful evidence for a narrow defensive boundary: untrusted descriptive text should not automatically enter the model's instruction or evidence context. It is not yet evidence that a production policy can preserve helpful summaries, distinguish instructions from facts and resist more subtle attacks.
A separate validator passed all 30 author-defined fixtures, but that confirms the validator behaved as specified on those fixtures; it does not measure attack prevalence or safe action-taking. The authors' wider evidence audit retained 39 sources and focused on 15 studies, but it was non-systematic, used one reviewer and did not provide complete search exports or screening counts.[1]
Live-web risk remains unmeasured
The study did not let an agent discover manifests on the live web, rank pages, follow links or take external actions. The manifest payloads and task summaries were written locally by the researchers, the eight sites were selected purposively, and there was no independent human adjudication. A post hoc AI-assisted review counted 22 rather than 21 target adoptions in the adversarial arm, but the frozen result remains the appropriate primary outcome.
The discovery evidence was also observational. Fifteen tools were tested three times each and made no incidental /llms.txt request. In a separate non-probability Ahrefs sample, roughly 38,000 detected HTTP-200 files appeared across 137,210 domains, and 97% had no recorded request in May 2026. Replication with public artefacts, several models, live retrieval logs, independently authored attacks and realistic guarded consumption would show whether this bounded response-steering result becomes an operational web risk.[1]