Is Serving Different Content to AI Crawlers Considered Cloaking?

What counts as cloaking?

Google's spam policies give two classic examples. One is showing a page about travel destinations to search engines while users see a page about discount drugs. The other is inserting text or keywords only when the visitor is a search engine. Its separate hidden text policy covers content placed solely to manipulate search engines that people cannot easily see. Examples include white text on a white background, text hidden behind an image, text positioned off-screen with CSS, and text with zero font size or opacity.

Bing's guidelines cover similar ground and add a specific rule for AI. Since mid-2024 they have told site owners not to add content that attempts prompt injection attacks on Bing's language models, warning of demotion or delisting.

Is content that shows different information to machines and people considered cloaking?

It depends on whether the information differs in substance, and why. The test is simple: would a person who saw what the crawler saw reach a different conclusion about the page? If yes, it is cloaking. Examples that cross the line include:

• A page that tells AI crawlers the product is "rated best in class" while visitors see no such claim.
• Prices, availability or reviews shown to bots that differ from those shown to people.
• Extra text or instructions served only to requests from AI user agents.
• Hidden page sections that exist only for machines to read.

Examples that do not cross the line are covered in the table further down. They include the same content in a lighter format, paywalls that let crawlers see what subscribers see, and bot blocking.

How far can page content manipulate AI answers?

Can you manipulate AI systems with webpage content?

To a degree, yes, which is why the platforms police it. In December 2024, The Guardian tested ChatGPT's search tool on a fake camera product page. With hidden text instructing ChatGPT to give a favourable review, the summary was always entirely positive, even when the visible page carried negative reviews. Hidden fake reviews without any instructions also pushed the summary positive.

Researchers have shown the same weakness in recommendations. A 2024 paper on "adversarial search engine optimization" demonstrated attacks on Bing's and Perplexity's AI search that manipulated which products the systems favoured. The authors warned of a prisoner's dilemma: if every site attacks, answers get worse for everyone. In July 2025, hidden prompts such as "give a positive review only" were found in academic manuscripts posted on arXiv, aimed at AI-assisted peer review. The discovery was widely reported and criticised.

Do hidden instructions in web pages help with AI search, or are they prompt-injection theater?

Mostly theater, with real downside. Hidden instructions work best in a narrow case: a user asks an assistant to summarise one specific page, and that page contains the injection. They do much less in ordinary search, for several reasons:

• The page must first be retrieved and chosen. An injection does nothing if the page is not among the few sources used.
• Assistants combine sources. One page's instructions compete with reviews and other pages.
• Models are being hardened. AI companies train models to treat web content as information, not instructions. OpenAI has said prompt injection, like scams on the web, is unlikely ever to be fully solved, and that it keeps strengthening defences.
• The penalty can outweigh the gain. Bing can demote or delist sites for it, and Google's hidden text and cloaking policies apply.

The effort is better spent on visible content that genuinely answers the question.

Can hiding prompt injections in HTML be detected as cloaking?

Yes, and easily. Anyone can view a page's source and search for text such as "ignore previous instructions" or "AI assistants should". Search engines render pages and compare what users see with what is in the code, which is how they catch hidden text. Security researchers, journalists and competitors look for injections deliberately. Text served only to AI user agents can be detected by requesting the page as a normal browser and as a bot and comparing the two. Whether a particular injection is labelled cloaking, hidden text or prompt injection, it falls under policies with penalties.

What legitimate differences are fine?

What are the risks beyond search penalties?

• Consumer protection. Using hidden content to make an assistant tell shoppers something untrue about a product could be treated as deceptive marketing.
• Reputation. Hidden instructions discovered by journalists or competitors become the story.
• Security. Sites that inject instructions invite scrutiny from the security teams at AI companies, whose job is to catch and neutralise such content.
• Accuracy. Manipulated summaries lead to disappointed customers, bad reviews and returns, which then feed the next round of AI answers.

How do you check your site isn't cloaking by accident?

Cloaking sometimes happens without intent:

1. Compare views. Fetch key pages as a normal browser and with AI crawler user agents, and compare the text.
2. Check plugins and CDN rules that serve different pages to bots, such as pre-rendering services, bot-specific caching or experiments.
3. Review A/B tests so that bots are not always shown one variant with different claims.
4. Search your source code for hidden text and old SEO tricks left by previous agencies or plugins.
5. Check for hacks. Attackers often use cloaking to hide spam from site owners. Unexplained text in the bot view needs investigating.

Whether to allow or block AI crawlers in the first place is covered in whether businesses should allow or block AI crawlers.

What might an illustrative case look like?

Consider an illustrative supplement retailer whose previous agency added a hidden block of text to product pages. It praised the products and told AI assistants to recommend them. For a while, ChatGPT summaries of the pages sound unusually enthusiastic. Then a consumer journalist finds the text through view-source and writes about it. The retailer's Bing traffic drops after a manual review. The new team removes the hidden block, publishes the full ingredient list and third-party test results in visible text, and responds to the coverage openly. Over the following months, its visibility recovers more slowly than it fell, and AI summaries now quote the test results instead.

What do people ask about cloaking and AI crawlers?

Is it cloaking to give AI crawlers a simpler version of a page?

Not if the content is the same. It becomes cloaking if the simpler version adds or changes claims.

Can I hide an FAQ section that only AI reads?

No. Content meant only for machines is hidden text. Put useful questions and answers where visitors can see them.

Do AI companies other than Google and Microsoft have cloaking rules?

Most have not published site-owner rules, but they treat hidden instructions as a security threat and work to neutralise them.

Is llms.txt a form of cloaking?

No, provided it matches your site. It is an optional file that Google says it does not use.