AI-Only Content Estates Risk Becoming the Next Cloaking, Analyst Warns

Google has spent thirteen years punishing content built for machines instead of people, and Chris Green argues the emerging practice of publishing AI-only brand content repeats that exact mistake. His analysis, published on Chris Green SEO, draws a hard line between formatting existing information for agents and manufacturing a second, hidden version of a brand.

The starting question is blunt. Why would an AI search provider have a long-term incentive to trust information a brand deliberately keeps separate from its public website? Green does not answer it. He says nobody can yet.

What does history say about hidden content?

Green traces a clear pattern through Google's enforcement record:

• 2011: Panda targeted low-quality content.
• 2012: Penguin tackled link spam.
• 2022: The Helpful Content system rewarded content written to help people, not to attract search traffic.
• 2024: Updated spam policies clarified the position on scaled content abuse, regardless of whether AI or humans produced it.

Search engines built these rules because falsified relevance and authority degraded results, not because they disliked SEOs, Green writes. Google still explicitly identifies cloaking as spam. He concedes cloaking's definition is not simple to apply or detect. The parallels to AI-only content are, in his words, too close to ignore.

Early SEO relied on hidden text, keyword stuffing, doorway pages and cloaking. Each wave of manipulation produced a countermeasure. The takeaway is plain: engines invest in trust mechanisms the moment manipulation becomes systemic.

What is actually being built for agents?

Green separates two distinct practices. The llms.txt proposal offers a structured way to direct language models toward useful website content. Agent-specific markdown pages, dedicated endpoints and structured feeds are spreading alongside it.

Cloudflare's Markdown for Agents serves an alternative format of existing content. The information originates from the same page. Green calls this fundamentally different from creating new information that exists only for AI consumption. Same information in different formats is not the problem. Different information for different audiences is where the risk begins.

The appeal is obvious. Publishing on a real website has never been easy. Content ownership, CMS limits, design requirements, development resources, governance and approvals all block publication. A text file or a separate content estate bypasses all of it. Green calls that shortcut appealing, and warns it may be too good to be true.

Why is trust harder in AI search?

Google is not the only actor anymore. Green references his own earlier research into ChatGPT's search sources and found no single, consistent retrieval process underpinning every AI answer. Different systems, providers and retrieval pipelines shape what information gets discovered and used.

Some inherit established search infrastructure, including relevance and reliability evaluation. Beyond Google and Bing, other sources behave differently. AI systems do not automatically trust everything they receive, Green notes. But having mechanisms to identify reliable sources differs from having decades of experience fighting people who manipulate those mechanisms.

He also separates retrieval from trust. In his research on how agents behave, they exert the least effort possible, summarize, and move on. The right answer being available does not guarantee it gets used. His list of unanswered questions:

• How should an agent verify that AI-targeted information is accurate or consistent with what the brand tells real customers?
• What happens when the machine-readable version contradicts the public website?
• Who decides which is more trustworthy?
• Why should AI providers keep accepting information users cannot independently verify?

Is every agent format cloaking?

Green says no, firmly. He rejects claims that every AI-specific format is cloaking or manipulative. Structured data, XML sitemaps, APIs and product feeds have existed for years, and he insists brands should use them. The line sits between helping machines understand a business and creating content solely to influence AI output, especially content no human can readily access.

The incentive to manipulate is obvious, he writes, and AI providers' incentives run directly against it. They need accurate answers and user trust. They have no reason to encourage fragmented, hard-to-verify sources. He speculates, clearly labeled as speculation, that systems may validate information against other sources, treat agent-specific content with greater scrutiny, or limit its influence without independent corroboration. Assuming today's practices stay acceptable long-term is, in his words, worryingly optimistic.

What should brands do instead?

Generative AI has multiplied demand for specific, accessible information. People now ask detailed questions about products, services and experiences and expect complete answers. If the information is absent, AI systems look elsewhere or fail. Green accepts the publishing problem is real. He rejects the solution of a second content estate with separate maintenance, governance, a possible second tech stack, and consistency checks.

Most brands struggle to keep one website accurate, he writes. A second, less visible one is not the obvious fix. His closing formulation: information useful only to AI creates a governance problem; information useful only to people creates a visibility problem. The middle ground is a single authoritative source useful to both. He also cites Google's reluctance to endorse separate AI optimization practices, noting providers have little incentive to legitimize techniques they would then need to police.

What to monitor: whether AI providers begin treating llms.txt and agent-specific endpoints with documented suspicion or reward, and whether any 2025-era spam policy language extends cloaking definitions to divergent AI-facing content.