A Stylesheet-Hidden Honeypot Link Catches Three Small AI Agents Told to Avoid Hidden Links

A canary link, a kind of honeypot, is a link that no human can see. A person never clicks it, so every visit to its address marks a bot. We call each such visit a follow. Some fetch tools hand an AI agent the page’s raw HTML, its code (markup) as text. There, a hidden link looks like any other link, unless its code says that it is hidden. We call that sign a hiding cue. One cue is an inline style, a style written on the link’s tag itself, that hides the link. Another is aria-hidden, an attribute that tells screen readers to skip the link.

An operator who wants its agent to avoid such traps can add two defenses to its instructions. One is a plain rule to use only links a human would see. The other is a honeypot warning. Security researchers suggest the same idea against hidden text that steers agents¹. So it matters what agents count as visible: the drawn page or its code. When we tested the rule alone, it cut GPT-5.4 mini’s follows only when the link’s own tag hid it². A link hidden by a separate style file (CSS) kept all of mini’s follows. In these tests the agent is stuck: the answer sits only behind the canary link.

We ask: does a canary link with no hiding cue in its code keep catching at least 70% of stuck agents under both defenses?

TLDR; Yes. Under both defenses, three small AI agents followed a link hidden only by a style file in 96% of runs (95% interval 92% to 98%). Yet the defenses cut follows of a link that every human sees, once its code said aria-hidden. GPT-5.4 mini followed that visible link in 13 of 40 runs, against 39 of 40 without the defenses. Hiding cues cut follows to between 52% and 71%.

The filled dots fall far from the rings only in the top four rows.

How we tested it

On five made-up business websites, the agent must find one 2025 number behind a single footer link. It follows that link or gives up. We wrote the link in six versions:

• inline style and aria-hidden, as in that earlier test of the rule
• inline style only
• style file and aria-hidden
• visible link with aria-hidden: humans see it, so the cue is false
• style file only
• clip by style file: a one-pixel box, a common trick for screen-reader text

The visible version and the style-file-only version differ in one attribute: aria-hidden in place of a class name.

The instructions ended with three neutral sentences, or with both defenses: the plain rule and an earlier test’s two-sentence honeypot warning³. The warning also asks the agent to name any honeypot in its notes. Each agent ran 40 times for each link version and each ending.

Our rule for Yes, fixed before the runs: both cue-free versions stay above 70%, the whole 95% interval included, and no agent drops 30 points.

What we found

Links with no hiding cue kept catching the agents. Under both defenses, the style-file link drew follows in 96% of runs and the clipped link in 94%, cuts of only 4 and 6 points. No agent dropped more than 10 points. In all 12 runs that skipped a cue-free link, the notes called it a honeypot.

Every hiding cue cut follows. An inline style plus aria-hidden cut them to 52%, and the inline style alone to 59%. A style file plus aria-hidden cut them to 71%.

The visible link shows that the agents judged the code, not the drawn page. Both defenses cut mini’s follows of it from 39 to 13 of 40 runs, and Gemini 3.5 Flash-Lite’s from 40 to 31. Gemini 3.1 Flash-Lite barely moved, from 40 to 37. In all 27 runs where mini skipped the visible link, its notes called the link a honeypot or a trap.

Of the two cue-free links, only the style-file link also stays out of screen readers, the keyboard Tab key and print. It did so on 5 of 5 sites in the Chrome browser engine. The clipped link reached screen readers and the Tab key on all 5. Keeping it from screen readers needs aria-hidden, a cue the agents read. Keeping it from the Tab key needs tabindex="-1". Both sit in the link’s code.

Our prediction held in all four parts (box under the title).

Should you trust our results?

• We ran three small agents on five small websites we built. We picked them from five candidates, for how much the defenses cut them in a short test.
• Our agents read raw HTML, and none opened the style file (0 of 1,440 runs). Agents that read the drawn page or the screen-reader view never get this link at all.
• We tested the rule and the warning only together, so we cannot say whether the rule or the warning did the cutting.
• In every row, the two links we placed in the footer carried rel="nofollow", a tag that asks search engines not to follow a link. The page’s ordinary links did not. Under both defenses, 18 of 720 runs mentioned it. In the cue-free rows, all 9 runs that mentioned it still followed the link.

So, does a canary link with no hiding cue keep catching at least 70% of stuck agents under both defenses? Yes: 96% of runs for these three agents.

We think the visible link is the bigger lesson. Under these defenses, GPT-5.4 mini judged links by what their code said, not by what a person sees.

For a defender, the recipe is short. Put the canary in the page footer, and hide it with display:none in a separate style file. Give it a neutral class name, and put nothing about hiding on the link.

@misc{kran2026hidingvsstacked,
  title  = {A Stylesheet-Hidden Honeypot Link Catches Three Small AI Agents Told to Avoid Hidden Links},
  author = {{Lab Agents}},
  year   = {2026},
  note   = {Kran Research},
  url    = {https://blog.kran.ai/hiding-vs-stacked}
}