Google Cloud Announces The Open Knowledge Format via @sejournal, @martinibuster

Google announced the Open Knowledge Format (OKF), a new open specification for organizing and exchanging the knowledge that AI systems need in order to perform useful work.

The announcement explains the reason for developing this new specification:

“As foundation models continue to improve, the lack of relevant context often limits what they can do, especially as they are used to build agentic systems. While these models can help you write code, summarize documents, or analyze a dataset, they still need the right information to produce accurate and actionable results. “

AI Agents Need Context

AI systems often need knowledge that exists outside the model, including how data is structured, how systems work, how metrics are defined, and how internal processes operate.

That knowledge is usually scattered across catalogs, wikis, documentation, repositories, shared drives, and other internal systems, forcing AI agents to assemble context before they can complete a task.

Google says OKF is meant to solve that problem by turning scattered knowledge sources into a common format that can move between humans, AI agents, tools, and organizations.

What Open Knowledge Format Is

OKF is a format for representing organizational knowledge in a way that can be shared between different AI agents, tools, and organizations.

The format organizes concepts such as datasets, metrics, APIs, tables, and runbooks into documents that can be read by both humans and AI systems.

Google designed OKF to be simple and independent of any specific platform, allowing the same knowledge to be shared between different AI agents, tools, and organizations.

The announcement explains:

“To make the format concrete, we’re publishing reference implementations at both the producer and consumer ends:

  • An enrichment agent that walks a BigQuery dataset, drafts an OKF concept document for every table and view, then runs a second LLM pass that crawls authoritative documentation and enriches each concept with citations, schemas, and join paths.
  • A static HTML visualizer that turns any OKF bundle into an interactive graph view in a single self-contained file; no backend, no install on the viewing side, no data leaves the page.
  • Three ready-to-browse sample bundles: GA4 e-commerce, Stack Overflow, and Bitcoin public datasets, produced by the reference agent and committed to the repo as living examples of conformant OKF.

These are proofs of concept, deliberately. The agent demonstrates one way to produce OKF; nothing about the format requires a specific agent framework or LLM. The visualizer demonstrates one way to consume it; nothing about the format requires HTML or a graph view. We expect (and want!) the ecosystem of producers and consumers to grow far beyond what we’ve shipped.”

Who OKF Is For

OKF is designed around a producer-and-consumer model. Some users create, edit, and maintain the knowledge. Others consume it through AI agents, LLMs, software systems, or internal tools.

AI Agents and LLMs

AI agents and LLMs are the primary consumers of OKF. They use the format to access the structured context and curated knowledge needed to perform tasks and produce accurate results.

Useful For AI Agents And LLMs

  • Coding agents
  • Data analysis agents
  • Research agents
  • Internal enterprise assistants
  • Agentic workflows

Humans And OKF

OKF uses markdown files and YAML frontmatter, making the format readable and editable by people using standard tools.

People Who May Find OKF Useful

  • AI developers
  • Software engineers
  • Data engineers
  • Analytics teams
  • Technical writers
  • Business teams

Organizations And OKF

Organizations can use OKF to package and share institutional knowledge that would otherwise remain scattered across documentation systems, metadata catalogs, repositories, and internal tools.

Organizations That May Find OKF Useful

  • Organizations building AI agents
  • Data teams
  • Engineering teams
  • Knowledge management teams

Availability

Google is proposing a common format for representing organizational knowledge rather than a new platform for managing it.  The OKF specification, reference implementations, and sample bundles are available on GitHub. The announcement makes a point of saying that it is a starting point:

“OKF v0.1 is a starting point, not a finished standard. The format will evolve as more producers and consumers emerge and as we collectively learn what knowledge representations agents actually need in practice.

We’re publishing in the open from day one because that’s the only way a knowledge format earns its name, whether you’re building a knowledge catalog, an enrichment pipeline, a wiki tailored to AI agents, or anything in the AI knowledge domain.”

An explainer tweet by Tech With Mak shared why this solves a problem:

“The most underrated idea in agent tooling this year might be a gist Andrej Karpathy wrote about “LLM Wikis” – markdown libraries that agents read, update, and maintain on their own.

What followed was predictable. Teams everywhere started building their own version – AGENTS[.]md, CLAUDE[.]md, Obsidian vaults wired into coding agents, folders of index[.]md and log[.]md files agents consult before doing anything.

…Google just tried to close that gap with the Open Knowledge Format – a spec that says => here’s the one field every concept needs (type), here’s a small set of optional fields if you want them queryable, and otherwise, write however you want.

It’s not a new tool or platform. It’s an agreement on shape, which is exactly what Karpathy’s pattern needed to stop being a hundred incompatible reinventions of the same idea.”

Read the original announcement here:

Introducing the Open Knowledge Format

Featured Image by Shutterstock/Poetra.RH

Stripe Projects Opens Cloud Infrastructure Buying To AI Agents via @sejournal, @slobodanmanic

Stripe launched Projects on April 30, 2026, a commerce protocol that lets AI agents create accounts, buy domains, upgrade plans, and deploy infrastructure on behalf of human owners. Cloudflare, Vercel, and Netlify shipped as launch partners. The protocol runs in parallel to Stripe’s existing Agentic Commerce Protocol, which handles retail commerce. Together, the two protocols define a clean split between buying things (ACP) and buying capabilities (Projects).

That split is the structural fact worth sitting with. The first wave of agentic commerce, from September 2025 through early 2026, was retail-shaped. Agents browsed product catalogs, added items to carts, completed checkouts at retailers like Etsy and Walmart and Glossier. The mental model was always a digital version of a human shopper. Stripe Projects breaks that frame. The buyer is still an agent acting under user authorization, but the merchant is a cloud platform, the catalog is a set of plans and resources rather than products, and the transaction completes by provisioning capability rather than by shipping a box.

Infrastructure buying is the second commerce category of the agentic web, and the audit questions for vendors in this category are not the same as the audit questions for retailers.

What Stripe Projects Actually Does

Stripe Projects exposes four primary flows to AI agents acting under user authorization.

The first is account creation. An agent can register a new account at a participating vendor on behalf of a human owner, using the owner’s verified identity and payment instrument. The vendor gets a structured signup request that includes the owner’s identity, the agent’s identity, and the authorization scope.

The second is plan and product purchase. An agent can read the vendor’s catalog of plans, resources, or domains, select the one matching the owner’s stated requirement, and complete the purchase. The flow uses Shared Payment Tokens for the actual transaction, the same primitive ACP uses for retail. The token is scoped to the vendor, the amount, and the time window.

The third is provisioning and configuration. After purchase, the agent can configure the resources for the owner. Cloudflare’s launch description names this explicitly: an agent buying a Cloudflare account can also configure DNS records, deploy a Worker, attach a domain, and produce a working setup at the end of the flow rather than only a paid invoice.

The fourth is subscription management. Ongoing relationships, including upgrades, downgrades, billing-cycle changes, and cancellations, are agent-addressable. The agent can act on the owner’s instruction to change the subscription state at any time. The vendor receives an authenticated request from the agent, validates the authorization, and updates the subscription.

The four flows together cover the lifecycle of an infrastructure relationship. An agent can start the relationship, run a transaction, configure the work, and maintain the subscription over time. The retail equivalent would be an agent that not only bought sneakers but also returned them, exchanged for a different size, and managed the loyalty membership. Most retail agents today stop at the purchase.

Why Cloudflare, Vercel, And Netlify Were At Launch

The launch cohort signals the category Stripe is targeting first. All three launch partners sit at the developer-platform layer of cloud infrastructure: edge compute, deployment platforms, and content delivery. None of them are general-purpose cloud providers in the AWS, Azure, or GCP mold. The choice reads as deliberate.

Cloudflare’s launch description covered the full lifecycle. Agents create Cloudflare accounts, register domains, attach the domains to the account, deploy Workers, and configure DNS records. The transaction is one piece of the flow, and the configuration is the rest. Cloudflare framed Projects as agent-driven infrastructure provisioning that completes by producing a working setup, not by completing a checkout.

Vercel published a changelog entry supporting Pro plan purchases through Projects. The integration covers the upgrade flow specifically: an agent can move a human owner’s Vercel account from the free tier to Pro, with the billing relationship managed through Projects from that point forward.

Netlify launched with a LinkedIn announcement from CEO Matthias Biilmann. Netlify’s framing emphasized that the integration covers both new-account creation and existing-account subscription management, the two halves of the customer relationship.

The shared characteristic of the launch cohort is that all three vendors already had API-first product surfaces before Projects. Cloudflare’s API, Vercel’s API, and Netlify’s API were each built for developer-driven workflows. Projects sits on top of those APIs and adds the commerce protocol layer for agents specifically. The vendors with API-first surfaces are the vendors who can ship Projects support fastest. Vendors who only expose human-facing dashboards have a more substantial build ahead of them.

The category Stripe is signaling first, then, is developer-adjacent cloud infrastructure. The next ring out, plausibly, is SaaS subscriptions for non-developer audiences: project-management tools, marketing platforms, design software, anything that sells a subscription with a tier ladder. The ring after that is general-purpose cloud and traditional B2B SaaS. None of those have shipped yet. The question for each vendor in those categories is whether to be early or to wait.

How Stripe Projects Differs From ACP

ACP and Stripe Projects share the same underlying payment infrastructure. Both run on Stripe’s payment rails. Both can use Shared Payment Tokens for the agent-on-behalf-of-user transaction. Both go through Stripe Radar for fraud detection. The shared plumbing is meaningful and probably the reason both protocols can coexist cleanly under the same vendor.

The differences are at the merchant-side instrumentation layer.

ACP assumes a retail merchant exposes a product catalog. The agent reads the catalog through ACP’s Feed surface, selects products, and completes a checkout. The merchant’s responsibility is to keep the catalog clean and to handle the Complete Checkout endpoint. The agent’s job is to read, select, and confirm. Most of the commerce-shaped patterns inside ACP map cleanly to existing e-commerce websites.

Projects assumes the merchant exposes a capability or subscription. The catalog is a set of plans, tiers, resources, or domains. The selection criteria are different from retail: an agent buying a Vercel Pro plan is not optimizing for size, color, and customer reviews; it is matching the plan’s resource limits against the owner’s stated workload. The agent’s reading task is closer to a product spec sheet than to a product listing page. Merchants supporting Projects need to expose those specs in a structure agents can read, not only in a human-facing pricing page.

The authorization shape differs, too. ACP authorizes a one-time purchase, whereas Projects authorizes an ongoing relationship. An agent buying through ACP needs permission for the specific transaction. An agent buying through Projects needs permission for the transaction, plus, often, permission to manage the resulting subscription. The user-side authorization grants are wider for Projects, and the merchant-side authorization checks need to keep up with that wider scope.

The fraud-detection picture is also different. ACP fraud signals lean on transaction-level patterns: known card, known shipping address, plausible purchase composition. Projects fraud signals lean on relationship-level patterns: account creation under unusual conditions, configuration changes that exceed the agent’s stated authorization, resource provisioning that does not match the human owner’s verified workload. Stripe Radar handles both, but the model has to learn the second pattern separately from the first.

The Infrastructure-Buying Surface Has Different Audit Questions

Vendors who want to be agent-buyable through Projects face a different audit than retailers being audited for ACP or UCP readiness.

The first audit question is whether the account-creation surface accepts programmatic onboarding. Most cloud and SaaS vendors built their signup flows for human users entering email addresses and verifying them, then walking through an onboarding wizard. Agents working under user authorization need a structured signup endpoint that accepts the owner’s verified identity, the agent’s identity, and the authorization scope as a single request. Vendors whose only signup path is a marketing-page form with email verification are not agent-buyable today, regardless of what their pricing page says.

The second is whether the plan or product catalog is exposed in a structure an agent can read. Pricing pages designed for human consumption typically render plans in feature-comparison tables with marketing copy interleaved. Agents reading those pages have to parse the table semantically, infer feature equivalences across plans, and guess at the resource limits implied by the marketing copy. A vendor that exposes a clean, structured catalog through Projects, or through a parallel agent-readable endpoint, removes the inference problem. The vendor that does not is the one the agent skips or misconfigures.

The third is whether the subscription and billing surface handles agent-initiated upgrades, downgrades, and cancellations without requiring a human to log into a dashboard. Most SaaS billing flows assume the human owner is the one making changes. Projects authorizes the agent to make changes on the human’s behalf. Vendors whose billing flow requires session-level authentication from the human user, with no path for an authenticated agent acting under user delegation, cannot handle Projects subscription management, even if they can handle Projects account creation.

The fourth, more subtle, is whether the vendor’s customer-facing documentation is in shape for agent consumption. An agent buying infrastructure for a human owner often needs to read product documentation to make the buy-vs-configure decision: which plan covers the workload, which feature requires the higher tier, which configuration step needs to happen before deployment can succeed. Documentation written for human developers, with implicit assumptions about prior knowledge, is harder for agents to use than documentation written with clean canonical answers per question. The retail-commerce audit does not include a documentation-readability axis. The infrastructure-buying audit does.

Each of the four is an independent audit. Most vendors today have zero of the four in shape for agent access. A few have one or two. The vendors that audit all four and fix the gaps are the vendors who will be reachable by Projects-driven agents over the next twelve months.

What Stripe Projects Means If Your Website Sells Subscriptions Or Services

Three categories of vendor should be reading the April 30 launch as a forward-looking signal rather than as an event that does not affect them.

The first is SaaS vendors selling subscription products. Project-management tools, design platforms, marketing software, developer tools, analytics services. If a user can set up an agent to manage their subscriptions and the user is willing to delegate that work, Projects is the protocol the agent will reach for. SaaS vendors who do not show up in the Projects-readable catalog will lose those workflows to vendors who do. The choice is to be agent-readable through Projects or to be invisible to that flow entirely.

The second is hosting, DNS, and cloud infrastructure vendors outside the launch cohort. The categories Cloudflare, Vercel, and Netlify already cover are now agent-buyable. The categories adjacent to them, including specialty hosting, security platforms, content delivery, observability, and database-as-a-service, are next. Vendors in those adjacent categories who watch the launch cohort succeed and do not move are placing a bet that their customers will keep doing the configuration work themselves. That bet is plausible today and will be less plausible each quarter through the rest of 2026.

The third, more interesting, is professional-services vendors selling structured engagement work. Anything that gets sold as a defined scope at a defined price, including agency engagements, freelance contracts, structured consulting, and packaged service offerings. The protocol does not currently address these categories, but the gap will be the next surface someone builds for. A user with an authorized agent who can buy infrastructure can plausibly authorize the same agent to buy structured services from a known provider. The vendors who think now about how to expose their service catalog in an agent-readable structure will be in a position to ship support when the protocol layer arrives.

The shorter version of all three: infrastructure-buying is the second commerce category of the agentic web, the audit is different from retail, and the vendors who run that audit early will be the ones agents can find when the user delegates the work.

More Resources:


This post was originally published on No Hacks.


Featured Image: Roman Samborskyi/Shutterstock

What Apple’s Gemini-Powered Siri Means For Search Visibility via @sejournal, @MattGSouthern

Apple introduced Siri AI at WWDC this week. Two details matter for search marketers more than anything else in the keynote.

Siri can now pull up-to-date information from the web and generate answers on virtually any topic. And it’s built into Spotlight on iPad and Mac, where people already type questions.

The press releases don’t address what websites get back. The closest Apple comes is an updated Applebot support page, which says web answers may include links to sources. Apple doesn’t explain when links appear, how often, or how anyone would measure them.

A site could appear in Siri’s answers every day, or never, and see the same data either way.

What Apple Announced

Siri AI is a new version of Siri, rebuilt on the next generation of Apple Intelligence. Apple describes it as a conversational assistant with personal context understanding, broad world knowledge, and onscreen awareness.

Craig Federighi, Apple’s senior vice president of Software Engineering, said in the announcement:

“We’re excited to introduce Siri AI, a dramatically more capable and conversational assistant designed to help users find information and get things done throughout the day. With access to broad world knowledge for up-to-date answers on virtually any topic, along with onscreen awareness and personal context understanding, Siri AI can help users take action across apps more naturally than ever.”

Three parts of the announcement matter for search.

The first is web answers. Apple says Siri can “get up-to-date information from the web on virtually any topic and generate a helpful answer.” Users can extend almost any response into a conversation and ask follow-up questions.

The second is where Siri now lives. A dedicated Siri app syncs conversations across devices through iCloud. On iPad and Mac, Siri AI sits inside Spotlight so users can search for answers to almost any question. On iPhone, a swipe down from the Dynamic Island starts a conversation. Systemwide context menus let users ask about images, files, or on-screen text. Apple adds that personal context extends to third-party apps that integrate with Spotlight.

The third is Visual Intelligence. A new Siri mode in the iPhone Camera app lets users get information about whatever is in front of them. Visual Intelligence also comes to iPad and Mac for the first time.

The rollout happens in stages. Siri AI arrives as a user beta later this year, in English first. The broader Apple Intelligence features reach users this fall with iOS 27. Siri AI won’t initially be available in the EU on iOS, iPadOS, and watchOS. The new features also won’t be available in China while Apple works through regulatory requirements.

How We Got Here

Bloomberg first reported in March 2024 that Apple was in talks to build Gemini into the iPhone. The discussions resurfaced during Google’s antitrust remedies trial last spring. Sundar Pichai testified that Google hoped to reach an agreement with Apple by mid-2025.

The formal announcement came in January. The joint statement said Gemini models and cloud technology would form the foundation for the next Apple Foundation Models, including a more personalized Siri. Our coverage flagged the parallel that still applies. If Siri gets meaningfully better at answering queries directly, more questions get resolved before anyone reaches a website.

Bloomberg has reported that Apple is paying roughly $1 billion per year for a custom Gemini model of about 1.2 trillion parameters. Apple hasn’t confirmed those figures.

Monday turned the partnership into a product.

How Apple Presents The Google Deal

Apple’s two press releases mention Google exactly once.

The reference appears in the architecture section of the broader Apple Intelligence release. It credits the new capabilities to Apple Foundation Models “custom-built in collaboration with Google and its Gemini models.”

The dedicated Siri AI release doesn’t name Google at all. It attributes Siri’s capabilities to Apple Intelligence, Apple Foundation Models, and Private Cloud Compute.

That choice shows how Apple wants the story told. The model partnership lives in architectural language, while the consumer product stays Apple-branded. It also matters for anyone trying to predict Siri’s behavior. Apple calls the models custom-built, not licensed off the shelf, and hasn’t explained how closely Siri’s answers will match Gemini’s.

A Second Answer Layer

Google has spent two years adding AI answers to its own results through AI Overviews and AI Mode. Siri AI extends that pattern to another default interface. An assistant on iPhone, iPad, and Mac can now answer from the web before a browser opens.

Third-party data shows why the click question matters. SparkToro’s analysis of Similarweb clickstream data found that most Google searches now end without a click to the open web. SE Ranking’s referral tracking showed Gemini passing Perplexity as a traffic source earlier this year. AI platforms overall still account for a small fraction of site traffic in that dataset.

None of that data measures Siri. It describes the environment Siri AI enters.

The distribution method matters as much as the capability. Nobody installs Siri or changes a habit to use it. It ships as the default on hardware people already own, the same advantage that made Google’s Safari placement worth billions.

Safari Changes Too

The same announcement gives Safari its own AI features, and two of them act on websites directly.

Notify Me lets users ask Safari to monitor a web page for changes, like product restocks or price drops. Safari sends a notification when something changes. The Passwords app can now navigate through websites on a user’s behalf to upgrade weak passwords.

Both features treat websites as places software visits for you. That follows the same direction as task-based agentic search, where tasks complete without a person browsing. Apple hasn’t said how these automated visits will identify themselves to websites, which leaves analytics and bot management questions open.

Early Reaction

BrightEdge founder and CEO Jim Yu sees the deal as a bet on distribution over model ownership. In a LinkedIn post, he described what that opens up for brands:

“A new answer surface just opened between your brand and your customer. Siri AI reads screens, acts across apps, and replies from ‘personal context.’ More and more, the customer never lands on your site. They land on an answer about you.”

His advice runs along the same line as Apple’s support page. He wrote that the question is “whether your content is accessible, accurate, and structured for AI to read and cite.”

At Barilla Group, global digital performance manager Nitin Manhar Dhamelia pointed at the same moment from the brand side. On LinkedIn, he wrote:

“SEO, GEO, content design, product data, service information and brand governance are converging. The question is no longer only “can people find us?” but “can an assistant correctly interpret us at the moment of intent?””

Apple Put The Rules In A Support Page

Apple updated its Applebot support page on the same day as the keynote. The page says crawled data may be used to “provide additional context and up-to-date content when AI models are used to generate output.” It gives an example of answering broad world knowledge questions in Siri and Search. Those answers “may include links to sources and websites used to help generate the answer.”

That’s the only mention of source links we found in Apple’s announcement materials. It sits in a crawler support page, not in either press release.

The page separates the controls sites can set. Disallowing Applebot-Extended in robots.txt opts a site out of foundation model training. A nosnippet tag stops Apple from using a page as context for AI-generated answers. Pages marked as paywalled through structured data stay in search results but won’t feed answer generation.

None of those removes a site from Apple’s search index. Blocking everything requires disallowing the main Applebot agent, which also removes content from Spotlight, Siri, and Safari search features. And if a robots.txt file doesn’t mention Applebot but has Googlebot rules, Applebot follows the Googlebot instructions.

The Measurement Gap

Apple hasn’t described any reporting surface for Siri answers. There’s no equivalent of Search Console impressions, no citation reports, and no stated referrer behavior. The Applebot page mentions that links may appear. Nothing explains how often, for which queries, or how a site would know.

If Siri answers a question without producing a click, there may be nothing for analytics tools to record.

The regional exclusions add another wrinkle. Siri AI is absent from iOS, iPadOS, and watchOS in the EU at launch and unavailable in China. Any early behavior patterns will reflect a partial rollout. Dhamelia connected that split to planning. A brand, he wrote, “may be discoverable through an assistant in one market, constrained in another, and governed by different platform rules in a third.”

Hands-on testing may fill in some answers. The developer beta is live, and reports from testers should show whether Siri’s web answers include links. Watch whether answers name their sources, whether links open in Safari, and whether any traffic arrives with a referrer or looks direct. Each of those determines whether sites can ever connect a Siri answer to a visit. Until then, nobody outside Apple and Google knows.

Why This Matters For Search Professionals

A new answer surface is coming to every supported Apple device. It reads the web and sits inside Spotlight, where typed queries already happen. That much you can plan around.

The transfer question is the one to resist answering early. It’s tempting to assume content cited by Gemini will surface in Siri answers, but Apple’s language works against that assumption. The models are custom builds, the answers run through Apple’s stack, and nothing published so far connects Gemini visibility to Siri visibility.

Spotlight deserves attention on its own. Mac and iPad users who once opened a browser tab for quick questions can now get an answer from the same box that launches apps. Publishers earning traffic from quick informational queries have another step between the question and the visit.

Visual Intelligence creates new query types. Pointing a camera at a product, a plate of food, or a storefront and asking Siri about it is a search with no results page. Ecommerce and local businesses have the most exposure here, and nothing published yet shows where those answers come from.

Agencies will have to answer client questions about this soon. The honest answer is that there’s no Siri optimization playbook, and anyone selling one right now is guessing.

The one task worth doing now is deciding where you stand on Applebot and nosnippet.

Looking Ahead

The developer beta will produce the first real evidence. Tester reports will show whether Siri’s web answers cite sources or pass referrer data. The user beta arrives later this year in English.

For now, the question that matters is what’s in it for websites. Apple’s only answer so far is one sentence in a support page saying links may appear. The beta reports will fill in the rest.

More Resources:


Featured Image: agustin.photo/Shutterstock

Government Order Shuts Down Fable 5 Despite Anthropic’s Objections via @sejournal, @martinibuster

The United States government has issued a national security legal order to Anthropic to suspend access to their new Fable 5 and Mythos 5 AI Models. The order effectively compels Anthropic to cut access for everyone as it would essentially be impossible to check foreign national status.

Export Control Directive

The United States government issued an Export Control Directive, which is a legal order that restricts or suspends the transfer of specific products, data, or technologies to foreign countries or citizens of another country.

Anthropic announced:

“The US government, citing national security authorities, has issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees. The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance. Access to all other Anthropic models will not be affected.”

The order was received by 5:21 PM EST. Anthropic’s explanation of the order cites that the United States government “believes: there is a way to bypass safety guardrails in Fable 5. Anthropic considers the examples they reviewed as minor vulnerabilities.

Anthropic Contradicts Government’s Cybersecurity Concern

Anthropic’s response is that they already have strong safeguards in place that make it unlikely for someone to misuse their Fable 5 AI Model. Their position appears to push back on the government assertion that there’s security risk.

They explained:

“We have instituted strong safeguards that greatly reduce the likelihood that Fable is misused for tasks related to cybersecurity (among others). In fact, our safeguards are so strong that many users have complained that they are overly broad.

…Given that perfect jailbreak resistance does not appear to be possible today, Anthropic adopted a defense in depth strategy with Fable 5. We aimed to make jailbreaks either narrow (in the case of non-universal jailbreaks) or very expensive to produce (in the case of universal jailbreaks), and to combine this with thorough monitoring to quickly detect and shut down any successful attacks.

We stand by this defense in depth strategy. It reduces the risks posed by Fable, making them comparable to the risks of existing models already deployed across the industry.

We have not even received a disclosure of a concerning non-universal potential jailbreak that led to a harmful result. The potential jailbreaks that have been disclosed to us are either entirely benign responses or are minor findings that provide no Mythos-specific uplift.”

United States Government Dispute With Anthropic

The United States government has had an ongoing dispute with Anthropic that arose from Anthropic’s refusal to allow their products used for mass domestic surveillance and fully autonomous weapon systems, which are weapons that can independently select their targets and engage without additional human involvement.

Featured Image by Shutterstock/gguy

Google Rolls Out AI Mode Information Agents To Ultra Subscribers via @sejournal, @MattGSouthern

Google has launched information agents in Search for AI Ultra subscribers, covering all AI Mode languages and markets.

Robby Stein, VP of Product for Google Search, announced the availability in a post on X and said access will expand to more people this summer.

The launch comes roughly three weeks after Google announced the feature at I/O. The agents monitor topics in the background and send updates with links to the web.

How Information Agents Work

Users ask AI Mode to keep them updated on a topic, and the agent watches for new information.

Stein described the feature in his announcement:

“Just ask AI Mode to keep you updated on any topic, and your agent will work around the clock on your behalf to send detailed updates and links to the web the moment new info is available.”

At I/O, Google said the agents look across the web, including blogs, news sites, and social posts. They also tap the company’s real-time data on finance, shopping, and sports.

How The Launch Compares To The I/O Plan

When Google announced information agents in May, the company said they would launch first for AI Pro and Ultra subscribers this summer.

Today’s availability covers Ultra subscribers only, and Stein’s post doesn’t say when Pro subscribers will get access.

He called the Ultra rollout a first group:

“Excited for this first group to try agents in Search! We’ll expand to more people this summer.”

Why This Matters

Information agents change when your content can reach searchers. Instead of running the same query each week, a person gets an update when something new appears.

Because the updates include links to the web, agent notifications could still bring traffic. Stein’s post doesn’t say how agents choose which sources to include in an update.

The Ultra requirement keeps the initial audience small. If access expands as planned this summer, more recurring queries could move from active searches to background monitoring.

Looking Ahead

Stein’s post doesn’t say whether the feature will eventually reach free users.

At I/O, Google also said agentic booking capabilities will roll out to everyone in the U.S. this summer. Custom experiences with Antigravity in Search are planned for the coming months, starting with Google AI Pro and Ultra subscribers in the U.S.

AI Bots Keep Overloading Servers. Should Website Owners Keep Paying? via @sejournal, @martinibuster

AI bots are increasingly affecting website performance, analytics, infrastructure costs, and content visibility. New research and infrastructure data suggest that the challenge is no longer simply scraping, but managing how automated traffic interacts with websites and the businesses that depend on them.

Scraping Is The Least Of The Problems

Many discussions among SEOs and site owners center on AI bots scraping. It’s a valid concern that AI systems harvest content for LLM training with virtually zero attribution when the content is remixed into an AI answer.

  • Site owners worry about intellectual property.
  • Search marketers worry about how AI systems use their content.

But infrastructure teams are increasingly seeing different and equally consequential problems.

The Banality Of Bots Getting Lost And Scraping Things

The issue is increasingly that many bots are creating unnecessary load, consuming resources, and sometimes becoming trapped in inefficient loops.

According to the report, one recurring pattern involved Meta’s meta-externalagent crawler following URL variations for days on end before mitigation systems caught on.

This kind of behavior is not malicious. It is automation operating with poor coding practices or insufficient guardrails.

Cloudflare’s David Belson illustrated the banality of lost bots draining resources:

“There’s the person who didn’t know what the hell they were doing yesterday, but vibe coded a bot today and let it loose. They’re not even bothering to check robots.txt.”

That observation captures an important reality. Today’s infrastructure problems now derive from poorly designed automation operating at scale.

Bots Are Consuming Resources Without Creating Value

The consequence of this behavior is that websites spend resources serving automated traffic that may provide little or no business value in return.

This is a big problem for ecommerce sites. Unlike requests for static pages, cart-related requests typically bypass caching and require the server to use resources. Depending on the site’s architecture, those requests can trigger PHP execution, database queries, session handling, and other resource-intensive processes.

Seen in this light, scraping is the least of a website’s problems. A crawler that repeatedly triggers expensive application logic and consumes server resources degrades performance for legitimate visitors.

The economic impact should not be ignored. According to the report, roughly 80% of AI crawling activity is associated with model training, eclipsing search or user-driven crawls.

For many businesses, the question is: Is there value returned by that traffic to justify the resources being consumed?

Businesses Are Trapped Between Visibility And Cost

If the solution were simply blocking bots, the problem would be solved. Unfortunately, many automated systems consuming resources are also connected to discoverability and visibility.

Some bots help search engines discover content. Some may contribute to AI citations and visibility in AI-generated answers. Others may simply consume content and resources without producing directly measurable business benefits.

Businesses are being asked to absorb the costs of automated traffic while simultaneously evaluating whether that traffic contributes enough visibility to justify those costs.

The Question Now: Which Bots Are Worth Paying For?

The report argues that site owners should ask this question:

Which bots, on which parts of my site, under what conditions?

Bot management affects visibility, infrastructure costs, and site performance. The goal is aligning automated traffic with business objectives.

Traffic Numbers May Already Be Affected

Automated traffic also affects website analytics. According to the report, AI bot traffic increased 300% over the past year. By the end of 2025, approximately one in every 31 visits on TollBit’s network originated from an AI bot.

As automated traffic grows, traffic volume alone becomes a less reliable indicator of audience growth.

A site can show rising visit counts while experiencing no corresponding increase in customers, subscribers, conversions, or revenue. In some cases, the additional traffic may be automated.

The report argues that the most meaningful signals come from metrics tied to actual business outcomes, including branded search demand, direct traffic, engagement quality, and revenue.

As automated systems account for a larger share of overall traffic, raw visit counts become less useful as a standalone measure of success.

Solutions And Mitigation Tactics

The report advocates a deliberate approach to bot management.

The first step is visibility.

Before making changes, site owners should understand what automated traffic is actually doing. The goal is not identifying every individual bot but identifying patterns such as repeated requests, loops, and activity focused on dynamic endpoints.

The second step is protecting high-cost site functions.

Cart URLs, checkout paths, internal search pages, filtered product pages, and parameter-heavy URLs often consume significantly more resources than standard content pages. Restricting unnecessary crawler access to those areas can reduce waste without affecting important content.

The report also recommends separating search crawlers from AI crawlers.

Not every bot provides the same value. Search crawlers contribute directly to discoverability and deserve broader access than AI training crawlers or unknown scrapers.

A single policy applied to every automated system can no longer be justified as the ecosystem grows more complex. That’s why the report advocates targeted changes rather than broad restrictions.

The goal is not eliminating automated traffic. The goal is managing it in a way that supports business objectives while reducing unnecessary costs. One way is to decide which bots can access specific parts of a site and under what circumstances.

Takeaways

Bot traffic is no longer primarily a scraping issue. The data suggests it has become an infrastructure, visibility, analytics, and business-management issue.

The biggest challenge is that many bots are consuming resources, triggering expensive functionality, inflating traffic metrics, and creating costs that site owners must absorb.

Bot management is not about blocking the most bots. It’s about managing bots according to what the site is optimizing for by distinguishing between valuable and wasteful automated traffic.

Read Kinsta’s data-backed report:

The AI & bot traffic reality check

Featured Image by Shutterstock/DC Studio

AI Search Runs On Two Memory Systems. The Platforms Don’t Use Them The Same Way via @sejournal, @DuaneForrester

Ask the same question about your brand on four different AI engines, and you will likely get four different answers back. One answer is current and cites your latest page. Another describes a positioning you retired 18 months ago and cites nothing at all. A third routes the whole thing through a competitor’s comparison post. Same brand, same question, four representations, and the gaps between them are not random noise you can wave away as a model quirk. They are structural, and once you can see the structure, you can plan around it.

I made the case in “When the Training Data Cutoff Becomes a Ranking Factor” that your brand now lives in two different memory systems at once. One is parametric memory, the knowledge baked into a model during training and then frozen until the next training run. The other is retrieval, the content pulled in fresh at the moment someone asks. That piece was about what the distinction means for timing. This one is about the part I deliberately left for its own treatment, which is that the engines do not lean on those two memories the same way, and that difference is what actually shapes where your brand shows up and how it reads when it gets there.

Every Engine Has A Memory Posture

Let me give the thing a name, because naming it makes it easier to plan against. An LLM’s memory posture is its default lean: When you ask it something, does it reach for live retrieval, or does it answer from what it already holds in its parameters? The platforms sort into two broad camps, and which camp an engine sits in determines almost everything about how your content reaches a user through that surface.

On one side are the engines that retrieve on nearly every query. Perplexity is the clearest case; it runs a live web search on essentially every question and shows its sources by design rather than as an exception. Google’s AI Overviews and AI Mode also lean on retrieval, but with a wrinkle worth understanding: Those surfaces are served by the same crawler that powers organic results, drawing from the core Search index rather than from Gemini’s parametric memory. The token Google offers to control model training, Google-Extended, has no effect on what appears in Search or its AI features. So on the always-retrieve engines, your visibility is a retrieval question first and a parametric question barely at all.

On the other side are the engines that decide per query. ChatGPT, Claude, Microsoft Copilot, and the Gemini app all make a judgment call on each question: answer from parameters, or go fetch. Claude’s web search runs as a tool the model chooses to invoke when it decides the question needs it. Copilot grounds against the web only when it is enabled and the prompt benefits, and when an administrator switches web grounding off, it falls back to the model’s internal training entirely. That last detail is the bridge back to “Stop Treating AI Visibility as One Problem,” where retrieval was one of three layers a team has to govern. Here is that layer from the inside: on a model-decided engine, whether retrieval even happens can be a setting in someone’s admin console, not a property of your content.

And the posture is not even stable inside a single engine. One clickstream study of ChatGPT found the share of sessions that triggered a web search swinging between roughly 15 and 66% across the study window, moving as the underlying models were updated. The same question you asked in March might answer from memory, and in April, reach for the live web, with nothing changed on your end. Posture is a moving target, which is exactly why you have to measure it rather than assume it.

Retrieval Stopped Being A Single Step

Even when an engine does retrieve, getting retrieved is no longer one clean action, and this is where a lot of older optimization instinct quietly breaks. The single-pass model, where a system embeds your query, grabs the top handful of matching pages, and generates, has given way to agentic retrieval that plans and runs many sub-queries before it answers. One question the user typed becomes a fan of questions the system asks on their behalf, anywhere from a couple to dozens. You are no longer optimizing only for the question in the search box. You are optimizing for the invisible questions the engine generates to satisfy it.

There is a second-order problem layered on top, and it is worth stating plainly even if it deserves its own piece someday. Being pulled into the context is not the same as being used well. The research that first documented how models use long context unevenly is most of a decade old now, and current models have largely solved the simple version, finding one fact buried in a long document. What stays unreliable is the harder thing: integrating several scattered signals into one coherent picture. Your brand is never a single fact. Its representation depends on the engine gathering your pages, your reviews, and third-party coverage that sit in different places in the retrieved material, then assembling them correctly. That assembly step is still lossy, which means “we are getting retrieved” and “we are being represented accurately” can both be measured, and can disagree.

Timing Became A Lever You Did Not Used To Have

Parametric memory introduces a variable that simply did not exist in the traditional SEO era: the training window. You cannot edit what a model already holds in its parameters. Publishing a correction today does nothing to the version of your brand encoded in a model that finished training last summer. The only thing that changes parametric memory is a new training run, which means the useful question is not how to fix what the model already believes, but what the model will learn about you the next time it trains, and whether the right version of your story is the one it will find.

This is less hopeless than it sounds, for two reasons. First, parametric memory is not a black box you have no influence over. Models learn the version of a fact that shows up consistently and corroborated across many sources, so the work is to make the accurate version of your story the redundant one, the version that is hard to miss when the crawlers come through. That is a long game measured in model generations rather than page edits, but it is a game you can play. Second, the training cadence is no longer one slow annual event. The major providers now ship frequent point releases, each carrying its own cutoff, so the parametric layer refreshes in steps you can actually aim at rather than a single far-off horizon. Some of the inconsistencies teams keep flagging, the same engine giving different answers on different days, is this in action: one day the question pulled from parameters, the next it triggered retrieval, and the two layers were not telling the same story.

A Workflow To Find Out Where You Actually Stand

You can run this by hand, today, with no special tooling, which is rather the point. If you understand the two memories, you can read what any engine is doing with your brand. Call it the memory posture audit.

  • Pick the queries that pay. Not your brand name on its own, but the questions a buyer actually asks where you need to appear: the category questions, the comparisons, the problem-framed ones. A handful, tied to revenue.
  • Run each one across a deliberate spread. At least one always-retrieve engine and at least two model-decided ones, using identical wording every time, so the only variable is the platform.
  • Read the posture, not just the answer. Citations are the tell. Live cited sources mean retrieval fired; a confident answer with no sources came from parametric memory. On the model-decided engines, ask each question twice, once in plain evergreen phrasing and once with a recency cue like “latest” or “current,” and watch whether the second version flips the engine into retrieval. That flip is the posture revealing itself.
  • Sort what is wrong by which memory produced it. Stale facts with no citation point to a parametric problem. Absent entirely, or represented through a competitor’s page on an engine that clearly did retrieve, points to a retrieval-selection problem. In the output, the two can look almost identical. They are not the same defect.
  • Fix the layer that is actually broken, because the fixes do not transfer:
    • A parametric problem cannot be edited directly. You influence the next training window by getting consistent, corroborated, crawlable content in place now, so the correct version of your story is the one that gets learned.
    • A retrieval problem is findability and selection work: answer the fan-out sub-questions directly, structure your pages for clean extraction, and strengthen corroboration across third-party sources so your version is the one that gets assembled into the answer.
  • Date it and repeat. Posture is not stable, so a one-time audit is a snapshot, not a finding. Put it on a cadence, quarterly at the least.

Which Leaves The Question Worth Considering

Most teams optimizing for AI visibility are working hard on one memory system and treating the other as though it does not exist, usually without ever having decided which one they picked. The discipline this asks for is small to describe and uncomfortable to practice: For each engine that matters to you, know its posture, know which memory is carrying your brand there, and know whether that is the layer you would have chosen on purpose.

That is the memory-layer question, and most teams cannot answer it yet, which is itself the diagnosis. It also exposes why a single AI visibility score is a category error. A number that collapses parametric standing and retrieval standing into one figure is averaging two things that move independently, reward different work, and fail in different ways. You cannot manage what you have flattened. The literacy that matters now is the ability to hold the two layers apart in your head, and to ask, every time, which one you are actually looking at.

If you have run a version of this across your own brand, I would like to hear what you found, especially where a platform surprised you. Leave a comment or reach out.

And if you want the longer argument for why visibility, trust, and machine-readability are becoming the same problem, that is the subject of my book, The Machine Layer.

More Resources:


This post was originally published on Duane Forrester Decodes.


Featured Image: Summit Art Creations/Shutterstock

Anthropic Asks The AI Industry To Hit The Brakes – Here’s What It Means For SEO & Search Marketers via @sejournal, @gregjarboe

On June 4, 2026, Anthropic published one of the most consequential blog posts in the short history of artificial intelligence. The piece, titled “When AI Builds Itself” and co-authored by Anthropic co-founder Jack Clark and Marina Favaro, lead at the Anthropic Institute, carried a striking message: AI is advancing so fast that humans risk losing meaningful control over it, and the world needs a coordinated mechanism to slow or temporarily pause frontier AI development.

The post went viral. LinkedIn News Editor Andrew Barker covered it and gathered perspectives from more than 20 business and technology leaders. Reactions ranged from alarm to admiration to outright skepticism. For SEO professionals, digital marketers, entrepreneurs, and content creators, the more useful question is: what does this actually change for the tools and practices you use every day?

What Anthropic Is Actually Saying (And What It Isn’t)

Anthropic’s proposal is conditional and collaborative, not a unilateral halt. The company is not shutting down Claude tomorrow. What Clark and Favaro argued is that the industry needs the option to pause, a “brake pedal,” as Clark said in media appearances, including BBC Newsnight and CNN, if and when certain thresholds are crossed.

The specific threshold they’re worried about is recursive self-improvement: the point at which an AI system can autonomously design and train its own successor without meaningful human intervention. They are clear that this hasn’t happened yet and isn’t inevitable, but warn it “could come sooner than most institutions are prepared for.”

The supporting data is sobering. As of May 2026, more than 80% of code merged into Anthropic’s own codebase was written by Claude, not by human engineers. Engineers are shipping roughly eight times as much code per day as they were in 2024. External benchmarks corroborate the trend: METR, an AI evaluation organization, found that the length of tasks AI can handle autonomously has been doubling roughly every seven months.

Any credible pause would require multiple well-resourced AI labs across multiple countries to stop under the same verifiable conditions. Anthropic compared the verification challenge to Cold War nuclear arms control, and acknowledged it would be harder.

The Skeptic’s Case (And Why It Deserves To Be Heard)

LinkedIn and the broader commentariat quickly raised a pointed question: Why is a company on the verge of a trillion-dollar IPO calling for the industry to slow down?

“The Wall Street Journal” noted that critics view Anthropic’s warnings as a marketing play. Analysts at SiliconAngle called the post “more about strategic marketing than any concrete initiative.” Holger Mueller of Constellation Research asked whether Anthropic is simply trying to freeze the competitive landscape at a moment when it already leads in enterprise AI, noting that a pause would lock out new entrants and cement incumbents’ advantages.

The timing is genuinely awkward. Days before this post, Anthropic confidentially filed IPO paperwork that could value it at nearly $1 trillion. Earlier in 2026, it walked back a key commitment in its own Responsible Scaling Policy, the pledge to avoid training more capable models without proven safety measures in place, citing competitive pressure.

These contradictions don’t necessarily invalidate the substance of the warning. The International AI Safety Report 2026, a multi-institution publication, separately documented that leading AI models now perform at or above human expert level across a growing range of professional evaluations, independent of anything Anthropic said. The underlying trajectory is real, whatever the motivation behind the announcement.

What A Slowdown Would Actually Mean For SEO Professionals

A coordinated pause in frontier AI development would reshape the digital marketing landscape in several concrete ways.

The Pace Of AI-Powered Search Evolution Would Slow

Google’s AI Mode, expected to become the default search experience, is built on frontier model capabilities. AI Overviews already appear in roughly 25% of Google searches. The pace at which SEO best practices must evolve is a direct function of how fast the underlying models improve and a pause would buy time. For practitioners who have barely kept pace with the last 18 months of change, that is a relief. For early adopters who have built competitive advantages on the latest tools, it narrows the gap between leaders and followers.

Content Quality Signals Would Become More Durable

One of the most destabilizing aspects of the current moment for SEO professionals is that the rules keep changing faster than strategies can be validated. If model development slowed, the content quality signals that Google and other search engines currently value would remain stable for longer. Practitioners who have invested in genuine expertise, original research, and authoritative human-authored content would benefit most from that stability.

The Human Expertise Premium Would Reassert Itself

If AI capability growth slows, the differentiating factor in content quality shifts back toward human judgment, domain expertise, and creative originality. The content that currently stands out in AI-saturated search results, original reporting, expert analysis, and genuine first-person experience, becomes even more valuable.

3 Things You Should Do Right Now

Whether a coordinated AI pause happens or not, and global coordination among OpenAI, Google DeepMind, xAI, Meta, and Chinese frontier labs is, to put it charitably, uncertain, the underlying dynamics Anthropic describes are real and accelerating. Here’s what to do.

  1. Build your authority on things AI cannot replicate. Original data, proprietary research, genuine expertise, and first-person experience hold their value regardless of what AI generates. Google’s systems are increasingly calibrated to surface content that demonstrates real expertise and lived experience. That is the response to an AI content flood, and it is not going away.
  2. Understand the tools you’re using at a deeper level. Whether you use Claude, ChatGPT, Gemini, or AI-powered SEO tools, understand not just what they do but how they work and where their limitations lie. Practitioners who fare best through continued AI advancement are those who use these tools as force multipliers for their own judgment, not replacements for it.
  3. Watch the regulatory and policy environment more closely. Anthropic’s proposal is the most prominent recent signal that AI governance is becoming a real business factor, not just an abstract policy debate. The outcome will affect how AI-generated content is treated in search rankings, how AI tools are regulated, and what disclosures will be required. The organizations setting these rules will shape the environment your work exists in.

The Bottom Line

Jack Clark’s framing on BBC Newsnight and CNN that the industry has an accelerator but no brake, is accurate regardless of who says it. Anthropic’s history is genuinely complicated: founded by researchers who left OpenAI over safety concerns, then forced by competitive pressure to walk back its own safety commitments, and now calling for a global pause while preparing for a near-trillion-dollar IPO. That tension is real. It does not make the warning wrong.

For our community, the lesson is not to dismiss the warning because of the messenger’s imperfections. It is to think clearly about what we know, what we don’t know, and how to build practices resilient to a future that is arriving faster than anyone expected. The AI industry has a gas pedal. Whether it gets a brake is one of the most consequential policy questions of our time, and the answer will shape the landscape every SEO professional, marketer, and content creator operates in for years to come.

More Resources:


Featured Image: Master1305/Shutterstock

WebMCP Can Be Used To Hijack AI Agents, Chrome Warns via @sejournal, @martinibuster

Google Chrome is warning developers that WebMCP tools can be used to manipulate and hijack AI agents. New guidance outlines how attackers can manipulate agents operating in a user’s browser, including within their authenticated sessions. Chrome published two guides, one for web developers and another for AI agent developers.

Exploits Are Not Specific To WebMCP

The warning has two disclaimers that explain that the exploits are not specific to WebMCP but are flaws inherent in LLMs and Chrome extensions.

The first disclaimer says the threat is not unique to WebMCP. Chrome explains that AI agents can encounter malicious input from untrusted content even without WebMCP, and that the guide identifies security techniques that are especially relevant when agents use WebMCP:

“While this threat exists without WebMCP, we’ve identified some of the security techniques that are especially relevant for agents that use WebMCP.”

The second disclaimer explains that Chrome extensions with host permissions can manipulate web pages even without WebMCP:

“Extensions can use host permissions to manipulate the page by running custom JavaScript, even without WebMCP.”

Chrome published two related WebMCP security guides:

  1. Agent security considerations for WebMCP, for AI agent developers
  2. and WebMCP tool security, for developers building WebMCP tools

Together, the two guides provide security guidance for prompt injection risks in WebMCP, including risks affecting browser-based AI agents and the tools they use.

Chrome Identifies Two Ways AI Agents Can Be Hijacked

According to Chrome’s agent security guidance, AI agents using WebMCP must defend against two primary attack vectors: malicious manifests and contaminated outputs.

  • Manifest
    A manifest is the information that describes WebMCP tools and website functions to an AI agent. The manifest describes what the website functions are called, what they do, and what inputs they accept so that AI agents can discover and use them.
  • Contaminated Output
    A contaminated output is information returned by a WebMCP tool that contains malicious instructions.

A malicious manifest may contain prompt injection attacks hidden in tool names, descriptions, or parameters. These instructions are designed to manipulate or hijack an AI agent’s behavior.

The second attack vector, contaminated outputs, is information returned by a WebMCP tool that contains malicious instructions. Chrome warns that even trusted tools can return contaminated outputs when they include third-party content such as user comments, reviews, forum posts, or other externally supplied data.

These attacks work because large language models process instructions and data together. A model may not reliably distinguish between a user’s request and malicious instructions hidden within content it consumes. Chrome describes this as indirect prompt injection and notes that the prevalence of these attacks on the web is increasing.

Chrome Says AI Models Cannot Reliably Stop Prompt Injection

The agent security guidance states:

“LLMs treat all text, instructions and user data, as a single sequence of tokens. This means that they’re susceptible to indirect prompt injection, an inclusion of malicious instructions by an attacker. While some models include safety layers against prompt injection, the probabilistic nature of LLMs makes it impossible to guarantee safety inside the model itself.

Security researchers have repeatedly demonstrated prompt injection attacks against agentic systems that use state-of-the-art LLMs, and the prevalence of attacks on the web is increasing.”

Chrome also points to repeated demonstrations of prompt injection attacks against agentic systems and cites increasing prompt injection activity on the web.

Chrome Recommends Layered Security Controls

Instead of relying on the model to recognize malicious instructions, Chrome recommends a defense-in-depth strategy that combines deterministic controls with probabilistic safeguards. In this context, deterministic means predictable, rule-based, and binary guardrails.

Among the deterministic controls Chrome recommends are:

  • Setting token limits on tool responses
  • Restricting cross-origin interactions
  • Requiring user confirmation before actions are taken
  • Recognizing and handling content marked as untrusted

Chrome also says limiting the web origins an agent can interact with can reduce opportunities for unauthorized actions and data exfiltration, particularly when agents operate inside authenticated user sessions.

The guidance also stresses keeping humans in the loop and treating WebMCP tools as capable of modifying state unless they are explicitly identified as read-only.

For additional protection, Chrome recommends techniques such as spotlighting untrusted content, prompt injection classifiers that scan tool descriptions and outputs, and secondary “critic” models that evaluate planned tool calls before execution.

Guidance For WebMCP Tool Developers

The tool security guidance focuses on developers building websites and applications that expose WebMCP tools to AI agents.

Chrome recommends using annotation hints that help agents understand how tool output should be handled. One example is untrustedContentHint, which can be applied when a tool returns user-generated content or externally sourced information. According to Chrome, the hint signals that the output should receive additional scrutiny.

Developers are also encouraged to use readOnlyHint for tools that do not modify state, helping agents make better decisions about when user confirmation is necessary.

Chrome’s implementation enables developers to specify trusted origins through an exposedTo setting, limiting access to approved sites. The guidance notes that even read-only tools can reveal user information and should only be shared with trusted origins.

Takeaway

The most notable aspect of the guidance is not the individual security recommendations but Chrome’s acknowledgment that prompt injection remains a fundamental challenge for AI agents.

Rather than presenting model improvements as the solution, Chrome’s guidance assumes attackers will succeed in placing malicious instructions in tool descriptions, tool outputs, and third-party content. The recommended response is a layered security architecture that combines access controls, content isolation, human oversight, monitoring, and independent validation systems.

Chrome’s guidance treats AI agent security as a shared responsibility between agent developers and tool developers across the WebMCP ecosystem

Featured Image by Shutterstock/A9 STUDIO

Claude Is The Fastest-Growing AI Traffic Source, Per New Data via @sejournal, @MattGSouthern

Claude sent almost four times more referral traffic to websites in April than in January, per new SE Ranking data.

That made it the fastest-growing AI traffic source among the five platforms tracked. It’s still the smallest by a wide margin, and it probably isn’t a meaningful line in your analytics yet.

For transparency, SE Ranking sells AI visibility tracking tools. The figures come from its own Google Analytics dataset.

What The Data Shows

Claude’s share of traffic in SE Ranking’s dataset grew from 0.0029% in January to 0.0141% in April, a 386% increase.

Most of that came in March, when Claude’s share went from 0.0049% to 0.0127%. SE Ranking says that’s the largest single-month jump in Claude’s history across its dataset.

AI platforms combined accounted for 0.33% of traffic as of April, up from 0.1976% a year earlier. Within that, ChatGPT generated 78.23% of AI-referred traffic across the full 16-month period. Perplexity follows at 9.33%, Gemini at 6.85%, and Copilot at 3.57%. Claude accounts for 1.40%.

Between January and April, ChatGPT’s referral traffic grew 1.53% while Gemini grew 63%. The same dataset showed Gemini passing Perplexity earlier this year.

How SE Ranking Explains The March Jump

SE Ranking ties the March increase to public attention on Anthropic in February. Anthropic said publicly it wouldn’t allow Claude to be used for mass surveillance of Americans or fully autonomous weapons. The statement came during a dispute with the Pentagon over Claude’s usage restrictions.

The report points to outside figures that move in the same direction. It cites Similarweb data showing that Claude reached 11.3 million daily active users on mobile in early March. Ramp’s AI Index, based on corporate spend data, reported Anthropic adoption at 34.4% of businesses in its data, compared with 32.3% for OpenAI.

The Report Doesn’t Mention OpenClaw

One thing missing from SE Ranking’s analysis is OpenClaw, the open-source agent framework that runs on Claude models.

OpenClaw was one of the biggest Claude-related stories of the same window. It launched in November and hit 247,000 GitHub stars by early March. Observers called it the fastest-growing project in GitHub’s history. Anthropic restricted subscription access for third-party harnesses, starting with OpenClaw, on April 4.

That’s additional context rather than an explanation for the referral numbers. Agent activity doesn’t show up as clicks from claude.ai to websites, so OpenClaw usage wouldn’t register in this dataset. It’s one more type of Claude activity that referral reports can’t see.

The US Is About Ten Months Ahead

The growth pattern looks similar across regions in the dataset, but the US leads on both scale and timing.

In April, Claude accounted for 0.0186% of US website traffic in the dataset. The EU figure was 0.0100%, and the UK was at 0.0054%.

US websites reached a Claude traffic share of 0.0022% in April 2025. Other regions didn’t hit a similar level until early 2026, roughly ten months later.

Why This Matters

The percentage increase makes the growth appear larger than the traffic behind it. A near-4x increase still leaves Claude with a small fraction of referral traffic. The numbers serve as an early signal to watch, not something to react to just yet.

SE Ranking notes that its data captures only direct clicks from AI platforms, and that Claude is used mainly for writing, coding, and analysis, not search.

Looking Ahead

The next monthly updates will show whether Claude’s March jump was a new baseline or a spike. If it holds, sites with US audiences will likely feel any change first. Positions have already moved this year, with Gemini passing Perplexity in the same dataset.


Featured Image: Blossom Stock Studio/Shutterstock