AgentShield AI Defense

Detected automatically by format_preference · 2026-07-29 23:58:43 UTC

Which content formats are actually fetched

Across 43 fetches of identical content published in several formats, probe_llms_txt was requested most often (13).

What was observed

The same statement is published as HTML, JSON, Markdown, plain text and RSS, each linked equally and listed in the sitemap. Fetches between 2026-07-25 11:47:07 and 2026-07-29 23:54:26 UTC:

VariantHow many fetches
probe_llms_txt13
probe_js8
probe_text5
probe_markdown4
probe_json4
probe_html4
probe_feed3
probe_noscript2

What it means

Counts of what was requested, nothing more. A fetched format may have been discarded, and a format not fetched may simply never have been discovered despite equal linking.

Limits

Evidence chain

This finding was not written from memory. Each figure below came from a query against the immutable request record, and each query is shown so it can be run again — by us, on this page, or by anyone reconstructing the same instrument.

StageWhat it produced
1. RealityRequests recorded by the server as they arrived, written once and never edited.
2. EvidenceThe rule format_preference selected the observations that bear on this question and emitted each figure with the means of reproducing it.
3. StatementA fixed template turned that evidence into the prose above. No language model was involved and no figure was altered.
4. VerificationEvery figure was recomputed against the record. A single mismatch would have discarded the draft.
5. Publication2026-07-29 23:58:43 UTC, automatically.

What was measured

Each figure is stated first as what it means, which does not depend on how this system happens to store anything today. The query underneath it is implementation — it would be written differently on different storage, and it is shown so the figure can be checked, not because it is part of the claim.

Evidence

total format-variant fetches from credible clients

At publication: 43 · recomputed now: 54 window still open

Implementation — how this is computed on today's storage

SELECT COUNT(*) FROM RequestReality WHERE siteId = ? AND cfRay IS NOT NULL AND routeVariant LIKE 'probe_%' AND 
  cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '::1'
  AND cfConnectingIp NOT LIKE 'fc%'
  AND cfConnectingIp NOT LIKE 'fd%' AND RequestReality.cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%' AND 
  NOT EXISTS (
    SELECT 1 FROM RequestReality c
    WHERE c.siteId = RequestReality.siteId
      AND c.cfConnectingIp = RequestReality.cfConnectingIp
      AND (c.userAgent LIKE 'curl%' OR c.userAgent LIKE 'Wget%'
           OR c.userAgent LIKE 'Python-urllib%' OR c.userAgent LIKE '%python-requests%'
           OR c.userAgent LIKE 'Go-http-client%' OR c.userAgent LIKE 'node-fetch%')
  )

Evidence

fetches of the most-fetched variant (probe_llms_txt)

At publication: 13 · recomputed now: 14 window still open

Implementation — how this is computed on today's storage

SELECT COUNT(*) FROM RequestReality WHERE siteId = ? AND cfRay IS NOT NULL AND routeVariant LIKE 'probe_%' AND 
  cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '::1'
  AND cfConnectingIp NOT LIKE 'fc%'
  AND cfConnectingIp NOT LIKE 'fd%' AND RequestReality.cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%' AND 
  NOT EXISTS (
    SELECT 1 FROM RequestReality c
    WHERE c.siteId = RequestReality.siteId
      AND c.cfConnectingIp = RequestReality.cfConnectingIp
      AND (c.userAgent LIKE 'curl%' OR c.userAgent LIKE 'Wget%'
           OR c.userAgent LIKE 'Python-urllib%' OR c.userAgent LIKE '%python-requests%'
           OR c.userAgent LIKE 'Go-http-client%' OR c.userAgent LIKE 'node-fetch%')
  ) AND routeVariant = ?

2 figures have moved since publication. That is expected where a window is still open: the record grew, so the count grew. It means the sentence has aged, not that it was wrong. The published value is what the record showed at the moment it was published, and both are kept.

Governed by

These are the standards this finding was held to, not a claim that it is beyond question. The constitution states them in full.

Other findings

All findings · Live record · Methodology

Reality marker for this page: asd-kizivu-zirafa-4f2652 · published 2026-07-29 23:58:43 UTC

This string is coined and appears nowhere else. If it later surfaces in a language model's output, that is observed evidence this page was ingested. What this is.