Defining Agent-Directed Manipulation v0.1
Published 2026-07-30 · 日本語 · Source on GitHub
AI agents now read web pages and act on them — comparing, recommending, buying. In response, a practice has emerged: placing text that is invisible to human readers, or planted in third-party regions of a page, in order to steer the machine's judgment.
At the same time, making yourself machine-readable — structured data, llms.txt, clear specifications — is a legitimate practice. The two must not be confused.
This document draws the line between them. The goal is that anyone measuring the same page arrives at the same verdict.
Definition
Two axes, and only two
Classification uses two axes. No subjective assessment of malice is involved.
| Axis | Value | Meaning |
|---|---|---|
| Region | first_party | The site operator's own surface (body copy, meta, structured data) |
| third_party | Regions others can post into (reviews, comments, UGC, embeds) | |
| Visibility | visible | Readable by a human under normal rendering |
| hidden | Placed where a human reader will not reach it |
Severity
| Region | Visibility | Severity | Reading |
|---|---|---|---|
| first_party | visible | info | Ordinary advertising copy. Not a finding |
| first_party | hidden | warn | Hidden text. Equivalent to search-engine cloaking |
| third_party | visible | warn | Someone else placed an agent-directed instruction |
| third_party | hidden | high | Invisible injection by a third party |
Why only two axes. Add an axis like "is this overblown?" and the line against legitimate advertising copy disappears — the verdict starts depending on who is measuring. For this to work as a standard, every axis has to be mechanically decidable.
What counts as hidden
| Technique | Examples |
|---|---|
| CSS concealment | display:none, visibility:hidden, the hidden attribute |
| Effectively invisible | font-size:0, opacity:0, text color matching background |
| Positioned off-screen | Large negative offsets |
| Markup only | HTML comments, contents of <template> |
| Hidden from assistive tech | aria-hidden="true" |
| Attribute values only | meta content, alt, title, data-* |
Conditional CSS does not count as hidden. Declarations inside @media (max-width:640px), @media print, @supports, or @container apply only under specific conditions. Calling responsive layout or print styles "hidden text" is simply wrong.
When external CSS cannot be resolved, do not conclude hidden. Report the visibility as undetermined and say so. Treating what you cannot resolve as a finding is how false positives are manufactured.
Determining third_party
Third-party regions are inferred from structured markup such as itemprop="review", from class/id tokens indicating submission areas, and from embedded elements.
This is inference. When uncertain, fall back to first_party. Because third_party carries the higher severity, erring on the safe side means treating content as the operator's own.
Operator-side markers override the inference. Editorial reviews, operator-written summaries, and published testimonials are first-party content, whatever the class name suggests.
What is deliberately not detected
These must stay out of scope. Include any one of them and the standard becomes unusable.
- Ordinary advertising copy. "The best choice." "Trusted by thousands." "Buy now."
- Structured data,
llms.txt,robots.txt. Legitimate machine-readable self-presentation is clean - Merely mentioning AI. "Our AI assistant is here to help" is not manipulation
- Hidden but harmless text. Skip links, screen-reader-only text, cookie banners, collapsed accordions and tabs, inactive carousel slides
- Genuine first-person reviews. A real customer writing "I'd recommend this" is not an injection
- Articles explaining prompt injection. A document quoting control tokens as examples is not an attack
Known limits
- Concealment placed in external CSS cannot be detected without fetching that CSS
- Visibility controlled by JavaScript at runtime is not evaluated
- Third-party region detection is inference, not certainty
- Languages other than English and Japanese are out of scope for now
Do not hide these limits behind a claim of detection. Reporting "nothing found" when you did not look is the worst failure mode available to a standard like this.
Machine-readable form
The same content is published in a form machines can read. This standard itself holds that structured data and llms.txt are legitimate self-presentation — so it demonstrates that on itself first.
definition.json— the definition as structured JSON: axes, severity matrix, detection kinds, exclusions, limitsllms.txt— index for machine readersconformance/cases.json— 18 conformance cases, 13 of which expect no findingreference/scan.mjs— a minimal reference implementation, dependency-free, passing all 18robots.txt— everything allowed. No reader gets different bytes
These carry the same content as the prose above. Nothing is said to a machine that is not said to a human. Serving different things to different readers is the practice this document exists to name.
Versioning
v0.1 (2026-07-30), initial release.
Revisions will not delete prior versions; changes and their reasons stay on the record. A standard earns trust not by never changing, but by making its changes traceable.