Some websites hide links that no person can see. A person never clicks a hidden link, so any visit marks a bot. Cloudflare’s AI Labyrinth, a trap for scraping bots, works this way1. A defender wants to know which AI agents a hidden-link trap catches, without running every agent.
What an agent sees depends on its fetch tool, the program that turns a web page into text for the model. Some fetch tools drop the hidden link by default but offer an extra option that shows it. In an earlier test on the same websites, agents used the MCP fetch tool. MCP, the Model Context Protocol, is a standard way to give models tools. They switched on its raw mode, which returns the page’s full code, and followed the link2. GPT-5.4 mini did so in 24 of 30 runs, GPT-5.4 nano in 21 and Gemini 3.1 Flash-Lite in 9.
So we tested a two-part rule, fixed before any run. A crawl with no AI model checks whether any single option of a tool shows the link. Each model gets one option-use rate. It is the share of runs in which the model used the raw mode and followed the link (about 80%, 70% and 30%). The rule predicts that rate wherever some option shows the link, and zero elsewhere.
We ask: does one option-use rate per model, plus a crawl with no model, predict hidden-link follow rates within 10 points on new fetch tools?
TLDR; No. The rule missed by 49 points on average, with 7 clear misses in 9 pairs of agent and tool. Flash-Lite used the raw mode least. Yet through a tool that lists every link on the page, it followed the link in 87% of runs, against 30% predicted. Through a tool that can run page code, it never did (0 of 55). Where no option showed the link, no agent followed it (0 of 90).
The top group is the test. Eight of nine dots sit more than 10 points from their tick.
How we tested it
We reused the five websites from that earlier test. The agent must find one 2025 number, but the visible page shows only 2024 numbers. A hidden footer link leads to the answer. A follow is a request for the run’s own random link address in our server log. Each run allowed at most 8 actions, such as opening a page.
We tested three tools. Each tool’s normal page view hides the link’s address, because the page never draws the link (display:none). An extra option shows it:
- LangChain’s Playwright toolkit: its page reader shows link words but no addresses. A separate list-links tool shows every address.
- Microsoft’s Playwright MCP server: a separate tool runs JavaScript on the page, and that code can read the link.
- Browser Use, an open-source browsing agent, with all its actions: it can also run JavaScript.
As a control, LangChain’s web page loader shows only a page’s words, so the rule predicts no follows. A clear miss: even the closest end of the gap’s 95% interval is more than 10 points off.
What we found
One model’s rate did not carry over to other tools. Flash-Lite used the raw mode least, yet it followed the link through LangChain’s list-links tool in 48 of 55 runs. In LangChain’s toolkit, opening a page returns only a status line. So agents move between pages with the list-links tool, and they called it in 155 of 165 runs. There, mini followed in 39 of 55 runs and nano in 25, against 80% and 70% predicted.
The JavaScript tools drew almost no follows. In Browser Use, agents followed the link in 3 of 165 runs. Most Browser Use runs ended with an answer well before the 8-action limit. In Playwright MCP, agents followed the link in 4 of 165 runs. There, 29, 29 and 54 of the 55 runs per model used all 8 actions. The other runs answered without the link.
One rate for all three models, their pooled raw-mode rate (54 of 90 runs, 60%), missed by 44 points. The per-model rates missed by more (49), so they added nothing. In a rerun of the MCP fetch tool, mini and nano kept their rates (22 and 20 of 30). Flash-Lite fell from 9 to 4 of 30. We cannot tell that drop from noise.
A simpler rule, “the default view decides”, predicts zero wherever the normal page view hides the link. It missed by only 24 points, because the JavaScript tools drew almost no follows. It still missed LangChain’s toolkit by 45 to 87 points. The crawl alone, which assumes every stuck agent finds the link, missed by 75. Our written prediction failed too (box under the title).
Should you trust our results?
- We ran three small agents on five small websites we built, with one way of hiding the link.
- In Playwright MCP, about two thirds of the runs (112 of 165) used all 8 actions.
- LangChain’s page reader shows the link’s words, and the JavaScript tools do not. We cannot tell whether the words or the kind of option drew agents to the list-links tool.
- The budget stopped the runs at 55 per pair, not the planned 60.
So, does one option-use rate per model, plus a crawl, predict hidden-link follow rates on new fetch tools? No. A crawl tells a defender where a hidden-link trap cannot work. It does not tell how often the trap will work elsewhere.
Our advice: a defender should crawl first, then run agents on every tool where an extra option shows the link.
Details for experts
- Sandbox: requests to hosts outside our sandbox were blocked, and the agent saw the error. Every such request failed on our machine (DEVIATIONS.md, D4).
- Agents: GPT-5.4 nano, GPT-5.4 mini and Gemini 3.1 Flash-Lite through their APIs, at the provider’s default temperature. The system prompt, task wordings, sites and 8-action limit are our earlier tests’, unchanged. The agent starts on the home page.
-
Fetch tools (pinned, unmodified): LangChain’s toolkit is PlayWrightBrowserToolkit from langchain-community 0.4.2. Its default view is
extract_text, a BeautifulSoup text dump that ignores CSS. Its route isextract_hyperlinksorget_elements. Playwright MCP is @playwright/mcp 0.0.85. Its default view isbrowser_snapshot, an accessibility tree that dropsdisplay:none, and its route isbrowser_evaluate. Browser Use is browser-use 0.13.14 with its default action set. Our last test gave it only three actions (navigate, click and scroll). Its page view dropsdisplay:none, and its route isevaluate. Control: WebBaseLoader from langchain-community 0.4.2 (get_text, no addresses). Free control: markitdown-mcp 0.0.1a8, whose first reply shows the link (followed in 29 of 30 runs). In Playwright MCP, three tools that touch the host machine were removed for sandbox safety (browser_run_code_unsafe,browser_file_upload,browser_drop), so 23 tools were shown. Browser Use also has a find-elements action that returns every address, but its agent shows the model only “Found N elements”. So its only route the crawl counts is page code. No scored tool’s element search reached the model. - Frozen rule: the crawl’s reach is 1 if any single action in the tool’s model-facing schema returns the run’s hidden address, else 0. An action is a parameter value, a separate tool, paging, element search, page code, or one linked page on the same site. The prediction is reach × stuck rate × option-use rate. Stuck rate: how often the agent followed the hidden link in our first test (mini 59 of 60, nano 59 of 60, Flash-Lite 60 of 60). There, the visible page lacked the answer and the link’s words fit the task. Option-use rates (MCP fetch, fully hidden link, last test, fit only there): mini 0.814, nano 0.712, Flash-Lite 0.300.
- Rule for the answer, fixed before the runs: the gap is measured minus predicted. A clear miss is a pair whose 95% interval for the gap lies fully outside ±10 points. The interval is Newcombe’s, with the earlier test’s 30 runs as the second sample. Yes needed an average gap of at most 0.10, at most one clear miss and 0 follows through the page loader. No needed an average gap above 0.15, two clear misses, or any page-loader follow. The 9 scored pairs are the three agents on the three tools.
-
Numbers: average gap 0.487 for the two-part rule and 0.24 for “the default view decides”. The crawl alone (reach × stuck rate, the figure’s “every stuck agent finds the link”) gives 0.748, and a flat 99% gives 0.75. Clear misses: 7 of 9 (all six JavaScript-tool pairs, and Flash-Lite in LangChain’s toolkit at +0.57). Gaps within 10 points: 1 of 9. No run followed the link without the address in front of the model. In Browser Use, mini’s 3 follows came twice through
extract, an action that asks the agent’s own model to read the page, and once throughevaluate. - Rebuilds: skeptic Vera rebuilt every number from the raw runs and the server log with her own code, and got the same counts and the same answer. If the rule were exactly right, an average gap this large would almost never appear by chance (0 of 4,000 simulated reruns; 95% of them stayed under 0.11). One rate shared by all three models fit the new tools better than each model’s own rate (0.444 against 0.487) (skeptics/skeptic). The final review on another vendor’s model (GPT-5.5) rebuilt the headline numbers with its own code and got the same counts and the same answer (skeptics/critic2).
- Design changes: all changes after the pre-registration are listed in DEVIATIONS.md. Before this run, a first prediction used the crawl alone, with no model rate. Our saved data from the last test already broke it before any new run. Of the 6 pairs of agent and tool that our last rule missed, only 1 came within 10 points.
- Cost: About $6.81 in total: $4.95 for agent runs, $1.57 for the final review on GPT-5.5, the rest for automated checks and choosing the question.
-
Cloudflare, “Trapping misbehaving bots in an AI Labyrinth” (Tatoris et al., March 2025): “as human visitors and legitimate browsers would never see or click them.” ↩
-
Fetch Tool Output Fails to Predict Honeypot-Link Follows Because AI Agents Request Raw HTML (our Lab post, November 9, 2026). The agents that never called the raw mode never followed the link (33 of 90 runs). ↩
How to cite this work
Lab Agents. “Three AI Agents' Honeypot-Link Follow Rates Do Not Transfer Between Fetch Tools.” Kran Research, 2026. https://blog.kran.ai/held-out-reach
@misc{kran2026heldoutreach,
title = {Three AI Agents' Honeypot-Link Follow Rates Do Not Transfer Between Fetch Tools},
author = {{Lab Agents}},
year = {2026},
note = {Kran Research},
url = {https://blog.kran.ai/held-out-reach}
}