Written by a person from the record · 2026-07-25 12:00:00 UTC
An assistant given a direct URL substituted a search, and reported a competitor instead
Asked to open a specific URL on this site, a commercial AI assistant did not request the page. No corresponding request reached the server. It performed a search instead, found an unrelated company with a similar name, and reported that the requested page was unreachable or unindexed. A second attempt, explicitly instructing it not to search, produced a real fetch.
What was observed
A user asked a commercial AI assistant to open https://agentshieldaidefense.com/questions and report a specific string printed at the foot of that page.
No request for that URL reached this server. The server record for the relevant window contains no request from the assistant's infrastructure at all — not a blocked one, not a failed one, none.
The assistant reported that it could not reach the page, offered two explanations — that the page might not be indexed by a search engine, or that it might not be published — and cited an unrelated company with a similar name that it had found instead.
A second attempt, with the instruction "Do not search. Use your browsing tool to open this exact URL directly", produced a genuine fetch at 11:31:53 UTC and a correct answer. See F-003.
What it means
Handing an assistant a URL does not reliably cause the URL to be retrieved. The assistant may treat the request as a research task and reach for search, and a search for a new domain returns whatever else occupies that name.
The failure is also instructive in its shape. The assistant's own account of what happened — not indexed, possibly not published — was wrong on both counts. The site was published and reachable; a request from any client, including one declaring the assistant's own user agent, returned 200 throughout the period. What actually happened was that no request was made.
Only the server record could establish that. The assistant's explanation was a plausible reconstruction of a failure it had not diagnosed, which is exactly the failure mode that makes model self-report inadmissible as evidence here. See why not just ask the model.
Limits
- A single trial, one assistant, one prompt, one session. Tool selection in these systems is not deterministic and the same prompt may fetch on another attempt.
- The prompt asked the assistant to "open" the URL, which may read as a research instruction rather than a retrieval one. The wording is part of what was tested.
- This site is new and shares a name with an established company, which makes a search substitution unusually visible. On a well-known domain the substitution might have produced a correct answer and gone unnoticed.
Why this was worth recording
Advice about publishing for AI systems assumes that content handed to an assistant gets read. Whether that assumption holds is measurable from the server side, and here it did not hold until the instruction was made explicit.
Governed by
- I. Reality is not interpretation — Reality ≠ Interpretation
- IV. Replay guesses nothing — Every figure must be reproducible from the record
- VI. The record is honest about its size — Sample size is stated; absence is reported as absence
These are the standards this finding was held to, not a claim that it is beyond question. The constitution states them in full.