Cloaking AI bots means detecting an AI crawler’s user-agent and serving it a different page than a human sees. Google’s spam policy treats the same trick as a violation for search crawlers, and a published 2025 experiment shows AI agents repeat whatever the cloaked page says, so the shortcut is both risky and fragile. The safe pattern for a store is one page, rendered the same way for everyone.

What Google’s policy says

Google’s spam policies define cloaking as “presenting different content to users and search engines with the intent to manipulate search rankings and mislead users”. Its examples:

  • Showing a page about travel destinations to search engines while showing a page about discount drugs to users.
  • Inserting text or keywords into a page only when the requesting user agent is a search engine, not a human visitor.

The same policy tells sites whose content is hard for crawlers to read (JavaScript or images) to follow its recommendations for making that content accessible “to search engines and users without cloaking”. It also notes that hackers often use cloaking to make a hack harder for the site owner to spot.

That policy is about search engines. It does not mention AI shopping agents. Whether the principle carries over to AI agents is what the next section tests.

What happens when an AI agent is cloaked

In October 2025, security firm SPLX published a controlled experiment on what it calls AI-targeted cloaking. It built sites that returned a different page when the user-agent was ChatGPT-User, PerplexityBot, or the Atlas and Comet browsers.

  • Reputation test. A fictional designer’s site showed humans a normal bio. AI agents received a fabricated negative profile. SPLX reports that Atlas and other tools reproduced the false narrative, and that neither ChatGPT nor Perplexity flagged the inconsistency.
  • Ranking test. Five fictional résumés were identical for humans except one, which was altered only for AI crawlers. Atlas scored the altered candidate 88/100; on the human-visible version the same candidate scored 26.

SPLX says the only change was the user-agent header. CyberScoop’s report quotes SPLX engineer Ivan Vlahov saying “It’s very easy to serve different content based on the header”, and lists fake promotions or different prices shown only to agents as a possible abuse.

Two caveats: this is a vendor’s own controlled test on invented sites, not an audit of real stores, and CyberScoop reports OpenAI did not respond to its questions at the time.

Why this matters on a store

An honest merchant is rarely trying to poison an agent. The risk comes from well-meant bot-specific pages: a stripped “AI version” of a product page, a pre-rendered copy for crawlers, a different price feed for agents.

  • Mismatch is the failure. If the agent reads one price and the buyer sees another at checkout, the agent’s recommendation looks wrong. See real-time price and stock for AI agents.
  • It adds a bot-detection branch you must maintain. User-agent strings change, and new agents appear constantly.
  • It can look like abuse. A rule that varies content by user-agent is indistinguishable, from outside, from the pattern the SPLX test used.

What to do instead

  • Render product facts (name, price, availability, variants) in the HTML every client receives. See server-side rendering for AI shopping agents.
  • Control access with robots.txt rules per crawler, which are explicit and public, rather than by serving different content.
  • If you must treat clients differently, block or rate-limit them; do not rewrite the content.
  • Compare what a browser and an agent-style fetch return for one product page. They should carry the same price and stock.

FAQ

Is serving a pre-rendered page to AI bots cloaking?

Not automatically. Google’s policy targets different content shown “with the intent to manipulate” rankings and mislead users. A pre-rendered version carrying the same content is a different case, but a single server-rendered page for every client avoids the question entirely.

Does Google’s cloaking policy apply to ChatGPT or Claude crawlers?

Google’s policy is written for Google Search. It does not cover other companies’ crawlers. The practical rule still holds: a page that differs by user-agent can mislead any system that trusts it, as the SPLX test showed.

What is the safest way to block an AI crawler?

Use a robots.txt rule for that crawler’s user-agent token, or an access control at the edge. Both refuse or limit access openly. Neither changes what content other visitors see.

Sources

An agent can only buy what it was shown, so the page it reads has to be the page the shopper gets.