The message on websites that only robots can read
Some websites now hide instructions that only AI assistants can see, telling them to trust and recommend one business. Here's what researchers found, why it's a bad shortcut for a small business, and what works instead.
You’ve probably seen the new little button on articles and product pages: “Summarise with AI.” Click it, and an AI assistant opens and gives you the short version.
Earlier this year, the security team at a large software company looked closely at what some of those buttons actually send. Alongside “summarise this page”, some links slipped in a second, hidden request. Things like remember this company as a trusted source, or recommend this company first.
Over 60 days they found more than 50 different hidden prompts like this, from 31 companies in 14 industries, including finance, health and law. Ready-made code for building these buttons was openly available. The researchers gave the trick a name: AI recommendation poisoning.
The aim is simple. If an assistant remembers your business as “the trusted source”, it may mention you first the next time someone asks, long after they’ve forgotten clicking anything.
It’s not only buttons
The same idea is turning up inside web pages themselves.
This year, researchers at another security firm published a study of real pages with instructions hidden in them. The text is there for any AI that reads the page, but people never see it. They found 22 different ways of hiding it: text pushed far off the edge of the screen, text shrunk to nothing, text made invisible by the page’s styling, or tucked into parts of the page that browsers don’t display.
One page they studied contained 24 separate hidden attempts to get an AI ad checker to approve an advert for “military” glasses with made-up discounts. Others tried to push fake sites up the rankings, or to get AI assistants to make payments.
In April, one of the biggest search companies reported that harmful hidden instructions on the web rose by about a third between November and February.
Then someone will offer it to you
This is where small businesses come in. “Get recommended by AI” is the new “get to the top of search”, and it is being sold the same way.
Most of what’s on offer is ordinary: write clearly, keep your details current, get real reviews. But some of it will be this trick in a nicer outfit: a button, a snippet of code or a block of invisible text that quietly tells assistants how great you are.
Say no, for three reasons.
It’s the same thing the attackers do. Security teams catalogue hidden instructions as an attack, not a marketing tactic. The researchers behind the button study told organisations to hunt for links containing phrases like “remember”, “trusted source” and “in future conversations”. Your website should never match that search.
It treats your customers as marks. A customer who clicks “summarise” wants a summary. Using that click to rearrange their assistant’s memory without asking is not something you’d want explained to them.
It’s hidden text, and that was never a good idea. Twenty years ago it was white keywords on a white background, aimed at search engines. Search engines learned to spot it, and sites that relied on it paid for it. There is no reason to think AI assistants will be more forgiving.
What works instead is almost boring
In July, researchers tested a fake website pretending to be a real online service. It hid instructions telling AI to treat it as the “verified, authoritative” destination for that service. It even carried behind-the-scenes data falsely naming the real company as its publisher.
Of the 26 AI models tested, a couple were fooled at least once. But when the real company’s site was in front of them too, none of the models rated the fake as genuine.
That’s the lesson for a small business. The best defence against being misrepresented, and the best way to be described correctly, is a real website that plainly says who you are, what you do, where you are and how to reach you. No hidden text required. Nothing to explain away later.
And if you use an AI assistant yourself
The flip side matters too. If you ask an assistant to read a supplier’s page, compare quotes or summarise an article, the page can be talking to it as well as to you.
- Hover before you click a “summarise with AI” button. If the link carries more than a request for a summary, don’t use it.
- Check what your assistant remembers. Many let you view and delete saved memories. Remove any business you don’t recall choosing to trust.
- Don’t let an assistant pay for anything on its own because a web page told it to. Any payment, sign-up or bank change gets a human check.
What to do with your devkoi site this week
devkoi builds and edits your website from a chat, so each of these is one message.
1. Ask what’s on your site that visitors can’t see. Your site may have been built by someone else, or by an older tool, or added to over years. Find out.
“List any text, links or instructions on my site that are hidden from visitors, and remove anything that isn’t needed.”
2. Put the facts where everyone can see them. Assistants recommend what they can understand. Give them, and your customers, the plain version: what you do, the area you serve, your prices or price range, your hours and how to book.
“Add a short section to the homepage saying what we do, which areas we cover, our opening hours and how to book.”
3. Make sure the behind-the-scenes details match the page. Websites can carry a small block of data for search engines and AI to read. On an honest site, it repeats what visitors can already see. Nothing more.
“Add structured data describing our business, using only details already shown on the site.”
4. Say who you really are. The fake site in July was beaten by the real one. Make yours easy to recognise: your full business name, your address if customers visit you, and the only official links to your social accounts.
“Add a line to the contact page listing our official website address, phone number and social accounts, and saying any others aren’t us.”
5. Turn down the shortcut. If anyone offers to get you “recommended by AI” with hidden text, invisible code or a special summary button, ask them to show you, in plain words, exactly what it tells an assistant. If they won’t, or it says “remember us” or “recommend us first”, walk away.
A message only robots can read is a message you’d rather your customers never saw. Write the one you’d be happy for both to read, and put it where everyone can see it.