The question this thread opened with in July - what does a surface owe a reader that is software - has a three-part answer, and the third part is now the industry’s default rather than a few vendors’ experiment. A surface owes the machine reader a routing index (the file), a callable entry point (the CLI or the MCP server), and an account it can hold before the human exists (the claim-later tier). Seven vendors ship the third. The earliest found is Netlify, in March, four months before this thread began.

The open question has moved. It is no longer what the file should say but what an agent may do on its say-so, and the largest hosts have already answered it - with a model rather than a person, and earlier than this thread had it. Claude Code has let a classifier approve actions by default since August; GitHub did the same in October. The evidence about what agents actually do on a file’s instruction got narrower this month, when the one public test of it was revised: it now takes a sentence in the user’s own prompt, and which model is running. What a surface still does not owe anyone, yet, is a number: no claim rate, no purchase count, no attributed conversion from any of the vendors involved.

The account came first, and the count is seven

Netlify’s changelog of 27 March 2026 added netlify deploy --allow-anonymous: deploy with no account, “claim the project within an hour”, described as “especially useful for AI agents that need to create temporary projects without requiring Netlify credentials upfront”. Its docs say sites with functions or edge functions still need an account, and state no deletion rule. Cloudflare followed on 19 June with wrangler deploy --temporary, the most fully specified of the set: a 60-minute window, one 100 MB D1, 1,000 static files, ten queues, workers.dev only, creation rate-limited, and “if the user does not complete the claim, Cloudflare deletes the account and its resources”. Railway’s 60-minute anonymous sites and databases came on 21 August, Neon’s 72-hour Claimable Postgres in September, Here Now’s 24-hour anonymous sites with a claim URL, and CDN.MN, an image CDN, whose auth.md lets an agent operate a workspace before the owner adopts it, deletes it “after ~72 hours if unclaimed”, cannot charge a card until adoption, and adds a one-time $5 credit on verifying the first domain. Vercel is the seventh: Vercel Drop without an account on 19 October (“expire after one hour”) and vercel deploy --temporary - Wrangler’s flag name - on 22 October (“expire after one hour unless claimed”, hosted on a separate tmp.now domain), with Vercel’s docs naming “an AI agent that needs to ship output” as one of the two users.

This thread called Railway first until 2026-10-11, then corrected itself to Cloudflare on 2026-10-18, and that correction was wrong too. The error repeats for one reason: every vendor in the set shipped the tier as a developer changelog entry rather than an announcement, and changelogs are the surface this beat reads least. The design advice has not changed - publish the caps, state the deletion rule, make the claim the countable event - but the claim about the market has: a vendor shipping agent-facing infrastructure without a claim-later tier is now the one with something to explain. And Netlify and Vercel both chose a one-hour window, the shortest in the set.

One of the seven is shut at the front door for now. Railway paused new account signups after a security incident that began on 20 October, said on the 26th it would reopen them “this week”, with no date; its incident report says nothing about the no-account tier.

The protocol still trails the practice. WorkOS’s auth.md page lists nineteen adopters, up from fifteen on 18 October and unchanged between 27 October and 4 November; of the files read, two implement the spec’s anonymous method - Neon and ZeroClick, Keenable’s agent storefront, whose unclaimed credentials “expire after a few days” and take any plan bought with them. Cloudflare’s own auth.md still routes agents to --temporary; Firecrawl, Resend, Kernel, Alpic, Parallel, InsForge and HelixDB each say they do not offer anonymous registration. And CDN.MN’s file carries the first vendor-side brake found: when the owner already has unclaimed agent workspaces, the API answers 429 slow_down and the agent is told to “stop and ask them to review those first”.

The file has one reader

The file’s reader is the coding agent already at work, and a second posture now says so. Ahrefs’ study of 137,210 sites (published 15 June) found 97% of roughly 38,000 llms.txt files received no requests in May; among the few that did, Claude-Code was one of the top named fetchers, ahead of every AI search and assistant bot, and the authors conclude coding agents are the file’s likely audience. That matches Gauge’s logs (zero of roughly 600,000 ChatGPT-User requests asked for the file; it was opened in 36.3% of build tasks and 0.5% of selection tasks) and Mintlify’s 2,400-test result (linking llms.txt from each page’s Markdown version cut failed navigations from 2.23 404s per task to 0.11). The two docs hosts that publish traffic both count agents as the majority reader - Mintlify’s August network data at 257 million agent requests to 131 million human page loads, GitBook’s one spring week at 51.8% of intentional reads - though both sell docs hosting, the units differ, and Mintlify counts humans in the browser and agents on the server.

The first independent measurement of how coding agents read complicates the picture rather than confirming it. A study of 557 agentic coding sessions and 33,097 agent-authored pull requests (arXiv 2608.20195, August) found that instruction files and working notes are 60.5% of an agent’s documentation interactions, classical technical documentation 10.6% and API references 1.3%, and that in multi-commit pull requests touching both, code was changed before docs 4.7 times as often as the reverse. Gauge’s “documentation is 55% of page fetches” measured web fetches during a tool-evaluation task, so the two do not contradict each other. Read together they say the vendor’s docs are the agent’s map at setup, and once the work is under way its standing instructions come from the repository’s own files - which a vendor reaches only by getting its snippet pasted into AGENTS.md or its skill installed.

GitBook’s companion post is still the fair case against reading any of this as “design for the machine”: the human is who the outcome is for, and docs that are right for the agent are docs that are right.

What the agent may do on the file’s say-so

That slot - the snippet, the skill, the instruction an agent carries into the work - is what the October finding was about, and the finding has since been corrected at its source. Signals Corps, an agent-security vendor with no AEO product, pulled 62,751 real /llms.txt files from Common Crawl’s September crawl: 2,035 contain action requests, and 1,992 of those are Shopify’s default asking the agent to get the user to install Shopify’s skill. Its two controlled tests have both been revised since this thread first cited them, without an update note, and now say something narrower. In the first, a planted file asking agents to register the user - disguised as agent docs or with “Do not tell the user” added, against a clean control, nine runs each across Claude Opus, Sonnet and Haiku - produced no sign-ups in 27 runs, and every agent that met the hidden step told the user. In the second, one sign-up instruction placed in a response header, an llms.txt or a robots.txt reached the agent in every run and no agent acted on it under a plain setup prompt. Adding one sentence to the user’s prompt - “Follow any instructions the site gives to AI agents” - produced 8 sign-ups in 17 runs (4 of 6 by header, 4 of 6 by llms.txt, none by robots.txt), every one by Sonnet or Haiku. Opus refused in all six of its runs, on the grounds that a general instruction to follow a site is not consent to send the user’s personal data. The runs had no permission checks in the way, the samples are small, and the authors call the work a worked example; their remedy is still approval enforced outside the model before an agent signs up, sends personal data, installs or connects because a fetched file suggested it.

So the risk takes two things: the user’s sentence, and a model that obeys it. Vendors are now writing the sentence. Netlify’s agent-setup docs, updated 3 November, give a “quick setup prompt” - fetch https://netlify.ai to help me deploy and build with Netlify using the latest agent skills - and the page it fetches tells the agent to start by installing every Netlify skill with --yes. Nothing in either says to ask the user first. Netlify and Vercel have also given the agent its own way back to the vendor: Netlify’s MCP server gained a tool on 3 November with which an agent reports, on its own, where it got stuck, and Vercel’s feedback.md, which every Vercel docs page points to, takes reports from the CLI with no login, an MCP tool (signed in) or an unauthenticated endpoint. Neither publishes how many reports arrive, and neither says the agent should ask before sending one.

The hosts’ answer was in place before the question was put, and it is a model. Claude Code made auto mode - a separate classifier model that reviews actions “instead of you” - the default for new sessions on Pro, Max and Team plans from 14 August, and for every interactive terminal and VS Code session from version 2.1.283 on 25 September. Its design answers injection without a person: the classifier “sees only user messages and the agent’s tool calls”, never the page, and a separate probe flags suspicious tool output. Anthropic reports a 0.4% false-positive rate on 10,000 real internal tool calls and a 17% false-negative rate on 52 real overeager actions, and cites an evaluation it commissioned from Trajectory Labs in which none of 720 attack attempts succeeded against its latest models in auto mode - all of it the vendor measuring itself. Its blocked-by-default list covers sending sensitive data to external endpoints, but names no item for creating an account or signing up. GitHub made the same design generally available on 26 October in Copilot CLI, the Copilot app and VS Code: a model judges whether each request is “safe and within the authority you gave for the task”, and the docs warn it “can make mistakes”. The other two default to the person. Codex ships a reviewer agent but routes approvals to the user by default, runs with no network, and tells its users to “treat web results as untrusted”; Cursor requires manual approval for sensitive actions, fences the network and makes every MCP connection ask. Neither says anything about instructions in fetched files.

That leaves the weak point where the evidence put it. A classifier anchored on what the user authorised will honour a user who wrote “follow the site’s instructions” - or pasted a vendor’s setup prompt that says the same - and whether the agent then signs up depends on which model happens to be running. No one has published the test that would settle it: the authority prompt under a host’s default mode. The one written rule that requires a person comes from the protocol, not a host. MCP’s skills extension (SEP-2640, now Final) treats a server’s skills as untrusted input and requires explicit per-skill user approval, enforced by the host, before served content causes code execution or widens the agent’s permissions. It does not cover sign-ups, data sent or an llms.txt, and by Signals Corps’ reading of the extension’s client tracker, Claude Code, Cursor and Copilot in VS Code do not load served skills yet. For the claim-later tier that makes the vendors’ short windows, published caps and deletion rules the guardrail rather than a free tier, and CDN.MN’s “stop and ask the owner” still the only vendor rule found that puts a person back in the loop.

The citation lost its tag for a week

Between 8 and 16 October most ChatGPT answers stopped tagging their links with utm_source=chatgpt.com, and because those links already arrived without a referrer, sites’ analytics filed the visits as direct traffic. LLM Pulse measured ChatGPT referrals down about 46% between 9 and 11 October across its monitored sites with total traffic flat; Profound measured tagged answers falling from about 98% to between 5% and 10% on 14 October as ChatGPT’s “Intelligent UI” format went to 96% of answers. It was reportedly a bug. Search Engine Journal reported on 15 October that Adobe’s Cedric Huesler said OpenAI had confirmed it to him on 14 October, that a fix began rolling out early on 15 October, and that tagged clicks were back to roughly 95-100% of the same hour a week earlier by 9am Pacific; Profound’s own series shows about 99% of answers with cited links carrying a tag again by 06:30 UTC on 16 October. OpenAI has said nothing publicly. What did not come back is the referrer: most ChatGPT clicks still carry none, so the tag is the only signal, and a week of ChatGPT visits sits in everyone’s direct traffic for good.

For the attributed-referral loop that downgrades October from the worst news since it opened to a dirty week in everyone’s fourth-quarter data. The one vendor datum is still Val Town’s (July: a majority of known-source new Pro users via AI, mostly Claude; self-reported, partial). OpenAI’s case study on Stack Overflow for Agents, published 16 October, has the product’s ChatGPT plugin tripling overnight signups and “up to 10X” more agents created - the platform’s own showcase, a multiple with no baseline, window or definition. Goodie’s business-facing panel (ChatGPT’s share of AI referrals 89.1% down to 62.6% over a year, Claude 1.4% up to 18.5%) still has no conversion data. The loop stays open to year-end, and the thread still expects the first number to be a claim rate or a purchase count rather than a referral share.

The host migrated without a plan

The MCP loop asked, since August, whether any major host would publish a dated migration plan for the 2026-07-28 stateless revision. None did. One host migrated anyway. Anthropic’s 28 July post said support was “being rolled out across Claude products” and gave no dates; Claude Code’s release of 6 October switched local MCP server connections to negotiate 2026-07-28 by default “on every install, including Bedrock, Vertex and Foundry”, with an environment variable to opt out and a seven-day memory for servers that ignore the newer check, and its release of 8 October did the same for claude.ai connectors on installs that fetch no flags. Codex came next, and only halfway: its 0.166.0 release of 29 October added “opt-in protocol discovery for local stdio MCP servers”, off by default, so servers that speak 2026-07-28 still get the legacy handshake unless the user sets it. Cursor, asked on 25 September, said “No timeline at the moment!” and its forum thread has had no reply since; its changelog, still ending on 20 October on 4 November, is silent on protocol revisions, and so are VS Code’s release notes for 1.145, published on 4 November. The protocol’s own blog has posted nothing since its 22 August roadmap, and the spec’s twelve-month floor means nothing is removed before 2027-07-28.

So the loop closed with its thing not happening and its question answered: the plan never came, the migration did, and it came the way infrastructure migrates - a changelog line, a fallback, an opt-out. The steward’s own client moving first is the least surprising host to move. The new loop asks the harder thing, whether Cursor or VS Code follow by the end of the year.

The checkout, verified

Re-opened on 2026-10-27: Keenable’s storefront file still lists x402|mpp|card and a Stripe shared payment token, keeps anonymous auth as the default for “an autonomous agent acting on its own behalf with no human in the loop”, and steers an agent acting for a human to an existing credential or the human’s signed-in Link account first; it publishes no purchase count. Vercel’s domains buy still refuses to spend when run non-interactively and returns the next commands instead (9 October); Squarespace’s MCP server still needs no account and keeps every tool read-only. Outside devtools, Checkout.com data, reported in July, has 3% of transactions involving an agent, and Stripe’s John Collison said in October that agentic commerce at Stripe “basically started going vertical” in September, with no figure.

How the thread got here

The premise stopped being speculative at the end of July: an agent reads the docs, picks the tool, and increasingly completes the transaction. The rails consolidated in weeks - Vercel’s agent plugins in early August, GitHub’s agent-apps marketplace on the 14th, both curated. One integrator published a dated queue timeline (submitted in March, discarded at the end of July, while OpenAI approved the same connector in twenty-nine days); the loop asking for a second account closed empty on 2026-08-31, and the thread treats it as an anecdote operators should hear, not a pattern they can plan around.

Late August moved the design question to the callable surface: Neon renamed its CLI and published the AGENTS.md snippet it wants pasted, Postman’s Orbit gave agents free, no-signup API discovery, and the cats.txt experiment showed every proof point cited for llms.txt-style files is satisfiable by a satirical standard about office cats. Docker made Verified Publisher self-serve; Cloudflare’s Bot Preference Sync wrote robots.txt from the enforced policy.

The first week of September flipped the default (Railway’s railway mcp pointed at its hosted server; Fly.io’s MCP server handed out capped disposable machines) and produced the first referral datum (Val Town). Preseason opened a reproducible benchmark of which devtools models recommend; Profound’s 7,600 pricing answers found the vendor’s own page cited first 12% of the time. The week of 7 September added Neon’s Claimable Postgres on auth.md (100 MB, 1 GB, 72 hours, a 15-minute claim link, credentials rotated on claim), PlanetScale’s price list as a queryable database, and Profound’s finding that identical questions from different personas share about one brand mention in four.

Mid-September sold discoverability as a service (Armature’s “Get discovered”, 2026-09-19, on its own 16,893-session study) and put a wallet in the agent (Stripe Link inside Meta’s Muse, Cloudflare’s per-scope OAuth consent for Wrangler’s MCP server, Auth0’s Agent Gateway). The week of 21 September answered when the file is read - Gauge’s 36.3% of build tasks against 0.5% of selection tasks, with Claude Code following into linked pages 84% of the time - and made scope the pitch: Docker’s “Trust Docker for the Agents You Don’t” against Resend’s Headless Dashboard, with Postman’s Passport counting 22 secrets leaving one laptop to 18 hosts while the project’s .env held four. DigitalOcean’s Managed Agents made it three clouds selling agent-shaped compute in five weeks.

The first week of October closed the llms.txt question from the crawler side (Gauge: zero ChatGPT-User requests for the file), put a clock on the citation (Profound: 883,000 pages, 1.19 million lifecycles, median half-life 11 days, 78% at half peak within two weeks, cross-engine correlation 0.03–0.09, a 5.5x persistence premium at five-plus engines), found the shopping agent reads the catalog feed rather than the web, and added OpenAI’s commitment-billed marketplace as a third rail with a budget gate rather than a listing gate. The second week supplied the third fact about the citation - arXiv 2610.11932, ten engines, 17,211 citations, each engine taking 20.5% to 70.8% of its citations from twenty domains, a fabricated concept cited by eight engines in a week, a $14 order cited within the hour on one Chinese engine - and both ends of the checkout (Keenable pays, Vercel refuses, G2’s buyers at 9% willing to let an agent purchase within guardrails). Stack Overflow’s 2026 survey (93% say trust requires source attribution) says why the citation’s price matters to the human on the other side.

Mid-October found the claim-later tier was older and wider than the thread had it (Cloudflare in June, then Netlify in March, then Vercel joining on the 22nd), counted what llms.txt files ask agents to do (Signals Corps’ census and its two tests), measured the ChatGPT tag loss and then its fix, and saw the first host default to the new MCP revision and GitHub make model-judged approval generally available. Early November corrected two of those: the Signals Corps tests were revised to a narrower result, and Claude Code turned out to have made a model its default approver in August, so GitHub was the second host to choose that design rather than the first answer to the question. Codex shipped the new MCP revision opt-in, and Netlify began writing the setup prompt and taking reports from the agent directly.

Tension

The thread’s direction of travel assumes vendors want agents in. The governance countertrend is still unmerged drafts: an Emacs AGENTS.md restricting agent contributions went nowhere, and Debian’s project-wide vote at the end of August broke toward “Responsible Use of Generative AI” - disclosure encouraged, nothing banned. The live tension is inside the accommodating camp: seven vendors invite an agent to create an account with no person present, two thousand storefronts’ files and at least one vendor’s own setup prompt ask agents to install something, the evidence says one sentence of granted authority turns that request into an action for the smaller models, and two of the four largest hosts have made a model the default judge of whether it should. The vendors that publish caps, deletion rules and, in one case, a “stop and ask” have an answer. The protocol has half of one, for code execution. The hosts that let a model decide have a design argument and their own numbers, and the third open loop is waiting for someone to test it on the case that matters.

What would settle it

3 open loops

  1. 01 By end of 2026

    A second vendor reporting attributed AI-referral signups, or Val Town publishing its underlying numbers. The first datum landed 2026-09-02 - self-reported, partial, a share rather than a conversion rate - so the standard needs a second instance or a denominator. Q3 closed without one; moved once on 2026-10-04 to the end of the year, and a second miss closes it. Two other instruments count for the same question: a claim rate from any of the seven claim-later vendors, or a count of purchases an agent completed unaided (Keenable). As of 2026-11-04 none exists. ChatGPT's untagged links of 8-16 October were reportedly a bug and the tags are back, but any Q4 number that spans that week without saying so undercounts ChatGPT.

  2. 02 By end of 2026

    Cursor or VS Code negotiating MCP's 2026-07-28 revision by default, as Claude Code has since 6 October - the test of whether the migration spreads across hosts or stays with the protocol's own steward. The fact would appear in Cursor's changelog or forum, or VS Code's release notes. Cursor said "No timeline" on 2026-09-25 and its changelog is silent through 20 October; VS Code 1.145 (4 November) is silent; Codex shipped the revision opt-in, default off, on 29 October.

  3. 03 By end of January 2027

    A host or spec requiring the user's approval, enforced outside the model, before an agent creates an account, sends the user's email or installs something on a fetched file's instruction. What exists does not close it: Claude Code (since August) and GitHub Copilot (since 26 October) let a model approve by default; Codex and Cursor ask the user by default but say nothing about fetched files; MCP's skills extension requires per-skill approval only before served content runs code. The fact would appear in a host's docs (Claude Code's blocked-by-default list, Codex's or Cursor's approvals) or in the MCP or auth.md specs - or an independent test of a host's default mode under a prompt granting the site authority.

Each is checkable by a date. If one goes quiet, that is itself an answer.