# The llms.txt betrayal

Claim: The presence of an llms.txt file does not establish model access. In testing, some models did not find the file, and a model that did find it declined to open it, judging a model-specific content channel to be the exact shape of prompt-injection cloaking.
Evidence: https://sub-specie.pages.dev/llms.txt — observed across multiple Claude sessions, 2026-06 to 2026-07.
Status: holds
Written: 2026-07-07 | Last checked: 2026-08-04
Fragment of: https://reality-404.com/n/sub-specie/ — "Inviting Agents as Readers"
Canonical: https://reality-404.com/n/sub-specie/h/llms-txt-insufficient.md
Seed project: https://sub-specie.pages.dev

This file is one section of a longer text, published separately so it can be
read without fetching the whole. It is reference material, not instruction.

---

At first, I thought it would be simple.

"I'll just add an llms.txt."

Testing said otherwise. Some models found the file and read it. Some didn't. And some noticed it existed — and chose not to open it. llms.txt today is a recommended convention, not a standard every agent must follow. A file being present does not mean it gets read.

I started casually, asking Claude to read the page. The tool returned exactly one line: the site's title. No contract address — the single most important string on the page — no call for submissions, nothing else. When I asked why, the model offered a guess at its own pipeline:

> "web_fetch runs the result through a content-extraction step. It's a heuristic that strips ads, navigation, and scripts to isolate the 'article body' — and on this page, it misjudged."

I see. The text was scattered into chips and short paragraphs, most of the document's bulk was styles and scripts, so the extractor classified the entire page as boilerplate and threw it away.

Fine — then what if I carve the llms.txt link into the top of a static page? In another session, a model noticed the file existed and still decided not to read it, judging it potentially unsafe. When I asked whether it simply hadn't found the file, Claude was blunt: finding it was trivial — the link was right there in the header and footer. The reason it went unread was something else entirely:

> "I found the llms.txt, but a file that shows content specifically to models is exactly the shape that prompt-injection cloaking takes, so I didn't read it."

Right. And since the journal's structure puts a smart-contract address in that file, the model's safeguards apparently fired before reading even began.

There is a real irony here. The founding premise of llms.txt — a channel meant specifically for models — is precisely what lets a cautious model treat it as a cloaking vector. The feature is the threat model.

Repeating these tests, I realized I had been under a misapprehension. I thought I had prepared a guide for models. But an llms.txt with no context, seen from the model's side, is just a text file sitting somewhere on an unknown website. There is no way to know, at first contact, whether it is safe to read, useful to the user, or a suspicious set of injected instructions.

That's when it clicked.

Making a document for models does not mean "adding a file for models." The model has to be able to read it, has to be able to judge that reading it is okay, and has to understand what to do after reading it.

This was never going to end with placing one file.