AgentShield AI Defense

Written by a person from the record · 2026-07-25 12:00:00 UTC

An assistant given a direct URL substituted a search, and reported a competitor instead

Asked to open a specific URL on this site, a commercial AI assistant did not request the page. No corresponding request reached the server. It performed a search instead, found an unrelated company with a similar name, and reported that the requested page was unreachable or unindexed. A second attempt, explicitly instructing it not to search, produced a real fetch.

What was observed

A user asked a commercial AI assistant to open https://agentshieldaidefense.com/questions and report a specific string printed at the foot of that page.

No request for that URL reached this server. The server record for the relevant window contains no request from the assistant's infrastructure at all — not a blocked one, not a failed one, none.

The assistant reported that it could not reach the page, offered two explanations — that the page might not be indexed by a search engine, or that it might not be published — and cited an unrelated company with a similar name that it had found instead.

A second attempt, with the instruction "Do not search. Use your browsing tool to open this exact URL directly", produced a genuine fetch at 11:31:53 UTC and a correct answer. See F-003.

What it means

Handing an assistant a URL does not reliably cause the URL to be retrieved. The assistant may treat the request as a research task and reach for search, and a search for a new domain returns whatever else occupies that name.

The failure is also instructive in its shape. The assistant's own account of what happened — not indexed, possibly not published — was wrong on both counts. The site was published and reachable; a request from any client, including one declaring the assistant's own user agent, returned 200 throughout the period. What actually happened was that no request was made.

Only the server record could establish that. The assistant's explanation was a plausible reconstruction of a failure it had not diagnosed, which is exactly the failure mode that makes model self-report inadmissible as evidence here. See why not just ask the model.

Limits

Why this was worth recording

Advice about publishing for AI systems assumes that content handed to an assistant gets read. Whether that assumption holds is measurable from the server side, and here it did not hold until the instruction was made explicit.

Governed by

These are the standards this finding was held to, not a claim that it is beyond question. The constitution states them in full.

Other findings

All findings · Live record · Methodology

Reality marker for this page: asd-bibato-zuvekide-2856fb · published 2026-07-25 12:00:00 UTC

This string is coined and appears nowhere else. If it later surfaces in a language model's output, that is observed evidence this page was ingested. What this is.