Detected automatically by ai_agent_arrival · 2026-07-25 20:42:34 UTC

We asked Claude-User to read this page, and it did

A client declaring Claude-User made 4 requests across 4 distinct paths on 2026-07-25. Every one of them arrived inside a window in which we had asked this vendor to read a page here, so this is the result of a trial rather than an unprompted visit.

What was observed

First request 2026-07-25 20:33:22 UTC, most recent 2026-07-25 20:43:00 UTC.

What it means

We caused this. All 4 requests arrived inside a window in which we had asked this vendor to read a page here, so nothing on this page describes a client finding the site on its own. What it does describe is what that vendor's fetcher actually did once asked — which paths it took, whether it read robots.txt first, whether it ran the script — and that is worth recording even though we started it.

Strictly, arriving inside the window is correlation and not proof of cause; an unrelated visit could land in the same ten minutes. Here the correlation is not the reason for the claim — we know we asked, and the trial log says so.

This identity cannot be checked against anything

Anthropic publishes no machine-readable range list at any URL we could find (checked 2026-07-26)

So the declaration stands unexamined — not contradicted, and not corroborated either. This is a gap in what the vendor publishes rather than anything observed about the client, and it is stated here because the difference between "checked and consistent" and "not checkable" is invisible in a table of counts.

Limits

• The declared user agent is unverified. Any client can send any string, so this describes a claim rather than a confirmed identity.
• Published address lists change. This was checked against the lists as captured on 2026-07-26; a vendor that adds a range afterwards makes an older answer stale rather than wrong, which is why the capture date is stated with the result.
• Fetching is not ingestion. Whether any of this content persists in a model is measured separately, by the coined markers listed on the lab page.
• An arrival cannot be shown to be unprompted. Nothing in a request says why it was made, so “nobody asked for this” rests entirely on our own trial log being complete.
• One domain, observed continuously. Nothing here generalises to how this client behaves elsewhere.

Evidence chain

This finding was not written from memory. Each figure below came from a query against the immutable request record, and each query is shown so it can be run again — by us, on this page, or by anyone reconstructing the same instrument.

What was measured

Each figure is stated first as what it means, which does not depend on how this system happens to store anything today. The query underneath it is implementation — it would be written differently on different storage, and it is shown so the figure can be checked, not because it is part of the claim.

SELECT COUNT(*) FROM RequestReality WHERE siteId = ? AND cfRay IS NOT NULL AND userAgent LIKE ? AND 
  cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '::1'
  AND cfConnectingIp NOT LIKE 'fc%'
  AND cfConnectingIp NOT LIKE 'fd%' AND RequestReality.cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%' AND 
  NOT EXISTS (
    SELECT 1 FROM RequestReality c
    WHERE c.siteId = RequestReality.siteId
      AND c.cfConnectingIp = RequestReality.cfConnectingIp
      AND (c.userAgent LIKE 'curl%' OR c.userAgent LIKE 'Wget%'
           OR c.userAgent LIKE 'Python-urllib%' OR c.userAgent LIKE '%python-requests%'
           OR c.userAgent LIKE 'Go-http-client%' OR c.userAgent LIKE 'node-fetch%')
  )

SELECT COUNT(DISTINCT path) FROM RequestReality WHERE siteId = ? AND cfRay IS NOT NULL AND userAgent LIKE ? AND 
  cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '::1'
  AND cfConnectingIp NOT LIKE 'fc%'
  AND cfConnectingIp NOT LIKE 'fd%' AND RequestReality.cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%' AND 
  NOT EXISTS (
    SELECT 1 FROM RequestReality c
    WHERE c.siteId = RequestReality.siteId
      AND c.cfConnectingIp = RequestReality.cfConnectingIp
      AND (c.userAgent LIKE 'curl%' OR c.userAgent LIKE 'Wget%'
           OR c.userAgent LIKE 'Python-urllib%' OR c.userAgent LIKE '%python-requests%'
           OR c.userAgent LIKE 'Go-http-client%' OR c.userAgent LIKE 'node-fetch%')
  )

1 figure has moved since publication. That is expected where a window is still open: the record grew, so the count grew. It means the sentence has aged, not that it was wrong. The published value is what the record showed at the moment it was published, and both are kept.

Governed by

• I. Reality is not interpretation — Reality ≠ Interpretation
• IV. Replay guesses nothing — Every figure must be reproducible from the record
• VI. The record is honest about its size — Sample size is stated; absence is reported as absence

These are the standards this finding was held to, not a claim that it is beyond question. The constitution states them in full.

Other findings

• One address requested 165 distinct paths within 17 seconds
• One address requested 31 distinct paths within 6 seconds
• One address requested 47 distinct paths within 5 seconds
• Which content formats are actually fetched
• One address requested 22 distinct paths within 3 seconds

All findings · Live record · Methodology