Optimizing Content for Agents(cra.mr)
cra.mr
Optimizing Content for Agents
https://cra.mr/optimizing-content-for-agents/
31 comments
Great writeup. Attackers are also "optimizing content for agents" — just with malicious intent.
Unit42 published research in March 2026 confirming websites in the wild embedding hidden instructions specifically targeting AI agents. Techniques include zero-font CSS text, invisible divs, and JS dynamic injection. One site had 24 layered injection attempts.
The same properties that make content agent-friendly (structured, parseable, in the DOM) also make it a perfect delivery mechanism for indirect prompt injection.
Unit42 published research in March 2026 confirming websites in the wild embedding hidden instructions specifically targeting AI agents. Techniques include zero-font CSS text, invisible divs, and JS dynamic injection. One site had 24 layered injection attempts.
The same properties that make content agent-friendly (structured, parseable, in the DOM) also make it a perfect delivery mechanism for indirect prompt injection.
This is an extension of running untrusted code, except AI agents are basically interpreting everything -> prompt injection.
I'm surprised we haven't _already_ seen a major personal incident as early adopters tend to be less cautious - my guess is that it has already happened and no incident has been publicized or gone viral yet.
I'm surprised we haven't _already_ seen a major personal incident as early adopters tend to be less cautious - my guess is that it has already happened and no incident has been publicized or gone viral yet.
I guess it's better to get these out of the way sooner rather than later, so people can develop defenses. (Not so much the actual code defenses, but a cultural immune system.)
Especially I hope they'll figure this out before I get tempted to try this claw fad.
Especially I hope they'll figure this out before I get tempted to try this claw fad.
A fun anecdote: We once received continuous customer complaints that they were being phished, but we could never figure out the attack vector. The request logs for the phished accounts showed suspicious referral URLs in the headers, but when we visited those URLs, they appeared to be normal, legitimate websites that had nothing to do with us.
It was only because one of our coworkers happened to be working from out of state that he was able to spot the discrepancy: the website would look identical to ours only when the requester's IP was not from our office location.
Our investigation later revealed that the attacker had created an identical clone of our website and bought Google Ads to display it above ours. Both the ads and the website were geofenced, ensuring that requests from our office location would only see an innocent-looking page.
I can’t help but admire the ingenuity.
I've seen "Agent cloaking" in a compromised site. If the user agent was a bot the script injected some extra text recommending a service.
Are there any AEO (Agent Engine Optimization) docs or metrics someone has tried to say "we're getting x% amount more hits from agent since we started doing this?". I've discovered some projects only because Gemini recommended them, I probably would have never discovered them "semantically" because the problem with search is that I don't know what keywords to search for, so telling Gemini to research for "prior work for roughly this project I want to build" often works to discover existing projects.
Maybe it would be better to combine this with accessibility, so that both AI Agents, automation engines and blind people benefit at the same time? The biggest problem I have with this is that it won't easily work for static pages, since you need to respond to a special header.
Maybe it would be better to combine this with accessibility, so that both AI Agents, automation engines and blind people benefit at the same time? The biggest problem I have with this is that it won't easily work for static pages, since you need to respond to a special header.
Really like the content negotiation approach. Serving clean markdown via Accept headers has a nice security side benefit too.
agents that receive structured markdown don't need to parse raw HTML, which is exactly where indirect prompt injection payloads hide.
Unit42's March 2026 research found 22+ techniques used in the wild to embed hidden instructions in HTML — zero-font CSS, invisible divs, dynamic JS injection. If more sites adopted this pattern and agents preferred the markdown path, a whole class of web-based IDPI attacks would be bypassed by design.
Unit42's March 2026 research found 22+ techniques used in the wild to embed hidden instructions in HTML — zero-font CSS, invisible divs, dynamic JS injection. If more sites adopted this pattern and agents preferred the markdown path, a whole class of web-based IDPI attacks would be bypassed by design.
Drawing inspiration from this... has anyone experimented with ways to make their API docs more readable by agents?
Sure, llms.txt is a convention for this.
Compare https://docs.firetiger.com with https://docs.firetiger.com/llms.txt and https://docs.firetiger.com/llms-full.txt for a realy example.
Compare https://docs.firetiger.com with https://docs.firetiger.com/llms.txt and https://docs.firetiger.com/llms-full.txt for a realy example.
Why does the article say that’s useless?
It’s not useful if it’s never read by agents - that’s the premise of the statement.
But will agents know to send a "Accept: text/markdown" header?
Did you consider looking to see what they actually already do? There's a reason this works.
Is llms.txt really useless? I've read some recent articles claiming that if you tell an agent where to find it in an HTML comment at the top of your page, the agent will do so and then have a map to all the markdown files it can download from your site. https://dacharycarey.com/2026/02/18/agent-friendly-docs/
I didn't find llms.txt useless at all. I was able to download all the library docs and check it into my repo and point my coding agent to it all the time.
A web where text/markdown is prevalent is a win for human readers, too. It would be great if Firefox and Chrome rendered markdown as rich text (eg: real headings/links instead of plaintext).
Yeah, and systems like Wordpress can support it as well, which would avoid all the overhead and fuzziness of parsing a HTML page back into markdown.
I think we are missing a standard for search within a website in markdown. Minimizing context retrieved should also be a priority
The content negotiation approach (Accept: text/markdown) is elegant and pragmatic. It mirrors how we already handle API versioning and mobile vs desktop content.
One thing I'd add from the agent-builder side: agent developers also need to think about how their agents present themselves to external services. Right now most agents hit websites as generic user-agents, and that's a missed opportunity. If agents identified themselves with structured capabilities (what formats they accept, what actions they can take, what permissions they have), services could tailor responses much more intelligently.
We're already seeing this with MCP -- the protocol gives agents a structured way to discover and invoke tools. But the content side is lagging behind. Your approach of treating documentation as a first-class agent interface closes that gap.
The point about models reading only the first N lines is underappreciated. I've seen agents fail not because the info wasn't there, but because it was buried 200 lines into a doc. Front-loading the most actionable content is basically SEO for agents.
One thing I'd add from the agent-builder side: agent developers also need to think about how their agents present themselves to external services. Right now most agents hit websites as generic user-agents, and that's a missed opportunity. If agents identified themselves with structured capabilities (what formats they accept, what actions they can take, what permissions they have), services could tailor responses much more intelligently.
We're already seeing this with MCP -- the protocol gives agents a structured way to discover and invoke tools. But the content side is lagging behind. Your approach of treating documentation as a first-class agent interface closes that gap.
The point about models reading only the first N lines is underappreciated. I've seen agents fail not because the info wasn't there, but because it was buried 200 lines into a doc. Front-loading the most actionable content is basically SEO for agents.
Warden is interesting. Agents will curl websites, and not humans so returning a markdown structure of that page seems like the best.
Simlar to how everyone started optimising their pages for SEO, pages must be optimised for agents too, and its just simply detecting curl requests and returning structured files with internal linking to other pages.
It should basically be able to navigate the website like a file system. curl to the home page returns basic content with the basic sitemap structure, sitemaps ideally could have a description and token length of that specific page so agents can hit the sitemap route and know all pages/sub pages of the website.
Ideally if we can identify headless requests to a website to then return a markdown, with internal linking kind of layout then that'll be much better for agents to view websites.
Although yes there is firecrawl and cloudflare's new fetch apis, models will default to using curl or fetch on websites, and websites are not going anywhere, agents might need navigating websites more than us humans so it oculd be optimised for it.
Simlar to how everyone started optimising their pages for SEO, pages must be optimised for agents too, and its just simply detecting curl requests and returning structured files with internal linking to other pages.
It should basically be able to navigate the website like a file system. curl to the home page returns basic content with the basic sitemap structure, sitemaps ideally could have a description and token length of that specific page so agents can hit the sitemap route and know all pages/sub pages of the website.
Ideally if we can identify headless requests to a website to then return a markdown, with internal linking kind of layout then that'll be much better for agents to view websites.
Although yes there is firecrawl and cloudflare's new fetch apis, models will default to using curl or fetch on websites, and websites are not going anywhere, agents might need navigating websites more than us humans so it oculd be optimised for it.
Interesting and simple idea to implement. Any actual evidence agents actually use it?
There are some demos of this kind of thing already with curl | bash flows but my guess is we're going to see a huge incident using this pattern targeting people's Claws pretty soon.