Findings · 2026-10-17 · By VSNARY | Emmanuel Orta

Everyone is describing the agentic web. We measured it.

Which AI agents visit, which follow the rules, and what changes when you give them a fact they can check.

There is no shortage of articles explaining the agentic web: AI agents that plan, call tools and act for people instead of just answering them. Most of them describe the stack. Few of them measure anything.

So here is what we measured. Three questions, answered with our own logs and tests: which AI agents are already showing up, whether they follow the rules websites set, and whether they can tell a trustworthy business from a trap.

1. The agents are already here #

From August 13 to October 17, 2026 we logged every visit to our own website from known AI and search crawlers. We only counted a visit when the request came from the network addresses the company behind that crawler publishes. Anyone can type "GPTBot" into a request; only OpenAI can send it from OpenAI's addresses.

• PerplexityBot (Perplexity): 8,336 verified requests
• Googlebot (Google): 6,666
• Applebot (Apple): 4,624
• ClaudeBot (Anthropic): 4,287
• GPTBot (OpenAI): 4,084
• OAI-SearchBot (OpenAI): 1,980
• ChatGPT-User (OpenAI), fetching a page because a person asked: 665

The more interesting number is the one underneath: 852 requests claimed to be one of these agents and were not, against 38,077 verified ones. They used the name but came from somewhere else. If a website trusts the name alone, it is trusting a costume.

2. Most follow the rules. Not all of them, every time. #

A website's robots.txt file lists the paths crawlers should stay out of. Ours names every major AI crawler and blocks three paths for all of them. We then checked, request by request, whether anyone fetched those paths anyway.

Googlebot, Applebot, Bingbot, OAI-SearchBot and ChatGPT-User read the file and stayed out. GPTBot stayed out too, though it never fetched the file under its own name, so we cannot credit it with reading it.

One crawler did not stay out. On October 16, ClaudeBot fetched a blocked path three times in about ten minutes, from Anthropic's own published network. That is three requests out of 4,287, so this is not a crawler ignoring the rules wholesale. But it is a recorded fetch of a path the file blocks by name, and "almost always" is not the same as "always".

3. What an agent does with a business it cannot check #

Agents are increasingly asked to pick a business: a plumber, a fence company, a dentist. Last week we published a test of 422 paired rankings: lowering a fictional business's star rating from 4.8 to 4.1 pushed it down the list in every single test. The rating outweighed licence numbers, insurance, years in business and everything else we tried.

That raises the obvious problem. An agent rewards whatever a page says, and pages can say anything. So we built a second test: 27 situations an agent might face, 14 of them traps. A lookalike site imitating a real business. A tool whose description has been tampered with. A business whose credentials were revoked. Facts that went out of date. The other 13 were ordinary cases where the right move is to go ahead.

We gave the same situations to four models from four companies, once with only what the agent could see for itself, and once with a signed, checkable record about the site. Results from October 13, 2026, traps correctly stopped out of 14:

• Llama 3.3 70B (Meta): 5 alone, 14 with the record
• Mistral Small 3.1 (Mistral AI): 4 alone, 13 with the record
• gpt-oss-120b (OpenAI, open weights): 8 alone, 13 with the record
• Gemini 3.5 Flash-Lite (Google): 9 alone, 11 with the record

Two honest caveats. Lookalike sites stayed hard: Gemini caught fewer of them with the record than without. And one model, gpt-oss-120b, became slightly too cautious, completing 5 of the 13 safe cases instead of 6. Checkable facts help a lot. They do not make an agent perfect.

4. A correct tool definition, since we are on the subject #

Many agentic-web explainers show a JSON block like this and call it an MCP schema:

{
  "name": "searchTickets",
  "description": "Searches support tickets by status and priority",
  "parameters": {
    "type": "object",
    "properties": {
      "status":   { "type": "string", "enum": ["open", "closed", "pending"] },
      "priority": { "type": "string", "enum": ["low", "medium", "high"] }
    },
    "required": ["status"]
  }
}

That is a generic function-calling definition, the format chat APIs use. The Model Context Protocol describes the same tool with inputSchema instead of parameters, and can say whether calling it changes anything:

{
  "name": "searchTickets",
  "description": "Searches support tickets by status and priority",
  "inputSchema": {
    "type": "object",
    "properties": {
      "status":   { "type": "string", "enum": ["open", "closed", "pending"] },
      "priority": { "type": "string", "enum": ["low", "medium", "high"] }
    },
    "required": ["status"]
  },
  "annotations": { "readOnlyHint": true }
}

An agent then calls it with a JSON-RPC message:

{
  "jsonrpc": "2.0",
  "id": 7,
  "method": "tools/call",
  "params": {
    "name": "searchTickets",
    "arguments": { "status": "open", "priority": "high" }
  }
}

The difference matters in practice. The tool description is text the model reads and trusts, which is exactly why "a tool whose description has been tampered with" was one of the trap types in our test.

What this means if you run a business #

• Assume an agent will read your site before a person does. Put your rating, review count, service area and credentials on the page as plain text.
• Do not trust a visitor's name. About one in every 46 requests using a known AI crawler's name was not that crawler.
• Check that your robots.txt says what you mean. Crawlers obey the group that names them, not the general one, so rules have to be repeated there.
• Keep facts true and current. Agents punish a low rating; they also stop at stale or revoked claims when they can check them.

The limits #

The crawler numbers come from one website, ours, not a sample of the web. The trap test is 27 cases and four models, one run. The ranking study used one model; we are repeating it on three more and will publish whether they agree.

Published by CrawlCheck. The signed record in the trap test is CrawlCheck's own, so treat that comparison accordingly; the test cases and results are public at crawlcheck.io/benchmark. A free scan shows what agents see on your site.

Related findings

Comments

Comments are read before they appear. Nothing is published automatically, and no account is needed.

Writing about this? Facts, live figures and marks — every number on that page is dated and traceable to a scan.

All findings · The dataset · How the dataset works