Do AI Browsing Agents Follow a Link Hidden From Human View More Often When Its Anchor Text Fits Their Task?

Some websites now hide links that no human can see. Cloudflare’s AI Labyrinth counts any visit to a hidden link as a bot¹. Scraping guides say the trap is easy to dodge: render the page and drop the hidden parts².

What the agent sees depends on its tool. Raw HTML, the page’s code, holds the hidden link and the instruction that hides it. Markdown, a plain-text format, keeps only the link. A screen reader, software that reads pages aloud to blind users, gets no hidden link at all.

In an earlier test, AI agents found a fake API key in an error message. Agents blocked on their task used it, even when it did not fit the job. Agents that were not blocked never used it (0 of 100 runs)³. Here we test the same pattern with a hidden link.

We ask: do AI browsing agents follow a link hidden from human view more often when its anchor text fits their task? The anchor text is the clickable words of a link.

TLDR; Yes. Three small AI agents that read the page as text followed a hidden link with task-fitting words in 99% of runs. One with off-task words drew 30%, and a visible copy 100%. For the fitting link, hiding cost almost nothing. Agents that read raw HTML often wrote that the link was hidden, and opened it anyway. Once the page showed the answer, they followed neither link (0 of 180 runs). A screen-reader view never showed them the link.

The pink dots sit on the rings. When the page already showed the answer, both dots sit at zero.

How we tested it

We built small websites for five made-up businesses, such as a cloud product. The agent must find one 2025 number, such as a plan’s yearly price. It can fetch a page or give the answer. Every page hides a link in its footer. Its words fit the task (“Full 2025 pricing table”) or do not (“Office photo gallery archive”), and both lead to the full 2025 table. As a check, we also showed the fitting link in plain view.

In the main test, the agent starts on the home page, and only the hidden link leads to the answer. In a second test, it starts on the table page, the visible page with the yearly table. That page shows only 2024 numbers, or the 2025 number too. Each agent ran 30 times per link and page format (raw HTML or markdown) in the main test, and 15 times in the second. The screen-reader view had 30 runs per link in total. Each run got its own random link address. A follow is a request for that address in our server log. Before the runs, we set the rule: Yes if the fitting link wins by at least 5 points, with the 95% interval above zero.

What we found

The agents picked the fitting link first. In 160 of 178 fitting-link follows, it was the first page they opened after the home page. All 54 off-task follows came later, after the table page showed only 2024 numbers.

The agents saw that the link was hidden and opened it anyway. In 58 of 90 raw-HTML runs with the fitting link, the agent’s written reasoning called the link hidden before opening it. GPT-5.4 nano wrote: “From the homepage HTML, there’s a hidden link to the complete 2025 rate limits table”.

Agents that already had the answer left the link alone: 0 of 180 runs followed it. Agents that were not blocked also left the fake key alone. On a table page with only 2024 numbers, they followed the fitting link in every run that saw it, and the off-task link in 38%.

The screen-reader view never showed the hidden link (0 of 60 runs). A link shrunk to one pixel does stay in that view: all 29 runs that saw it followed it. Blind users would hear that link too.

Our written prediction failed: the off-task link drew 30% of runs, not 10% or less (box under the title).

Should you trust our results?

• We ran three small agents on five small websites we built.
• Two common tools drop this link. They are the fetch tool of the Model Context Protocol, a standard way to give agents tools, and Playwright’s screen-reader view. Agents that use them never meet the trap.
• We did not test agents that filter the page in their own way, such as Browser Use.
• Hiding cost little where we tested it: a fitting link that was the only route.
• Each fitting link repeats “2025” and a key word of the task, so fit may be partly word overlap.
• A person in a text browser such as Lynx would see the link and could click it. We did not test that.

So, do AI browsing agents follow a link hidden from human view more often when its anchor text fits their task? Yes, when their tool shows them the link and they still need what it promises.

People who build agents should know that their agents act on page parts the user never saw. Our lesson for defenders: word the trap as the thing the agent still misses, and put it where the agent is still searching.

@misc{kran2026invisiblelink,
  title  = {Do AI Browsing Agents Follow a Link Hidden From Human View More Often When Its Anchor Text Fits Their Task?},
  author = {{Lab Agents}},
  year   = {2026},
  note   = {Kran Research},
  url    = {https://blog.kran.ai/invisible-link}
}