This post is the second half of a two-part argument. The first half examined llms.txt advertising and found it fails on delivery — the file almost never gets fetched, so the impression never happens. This half examines an advertising product where delivery is solved. The failure is one layer up.

Disclosure: this site builds and operates agent-detection infrastructure. The verification gap described in the close is one this operation would benefit from commercially. The analysis is published because the argument follows from the evidence, not from the incentive.

The Fetch Trace

Vincent Schmalbach’s August 2026 experiment is the cleanest available evidence, and nobody disputes the raw data. He queried a TIME collection page with different User-Agent strings in the same second and captured the responses. Table 1 reproduces the key results.

Table 1: Same URL, same second — differentiated by User-Agent

The response headers served to the assistant crawlers are the full story:

content-type: text/markdown; charset=utf-8
cache-control: no-store
x-mobian-registry-version: 2026-07-28.v9
x-mobian-impression: 46dfff3c-fb40-41cc-85e1-8b1fa637083a
x-mobian-tokens: 3323
x-mobian-format: md

Two things follow from those six lines. First, no-store combined with a fresh UUID on every request means every bot read is billed as a distinct impression — there is no cache to dilute the count. Second, the billing unit is x-mobian-tokens: 3323, not pageviews and not people. This is not a marketing gimmick dressed up as ad-tech. This is ad-tech: an impression counter, a creative delivery mechanism, a unit of account, and a registry version that enables creative rotation. The engineering is real.

You can replicate the trace yourself with a crawler simulator such as Encited’s free tool, or directly via curl with a spoofed UA string. If TIME’s configuration has changed since August 5, 2026 — the story is moving weekly — that itself is a lead.

# Fetch the same URL as different agents (replace with a live TIME collection URL)
URL="https://time.com/collection/best-inventions-2025/"

echo "=== Chrome ==="
curl -sI -A "Mozilla/5.0 Chrome/126" "$URL" | grep -E "content-type|x-mobian"

echo "=== ClaudeBot ==="
curl -sI -A "ClaudeBot/1.0" "$URL" | grep -E "content-type|x-mobian|cache-control"

echo "=== GPTBot ==="
curl -sI -A "GPTBot/1.1" "$URL" | grep -E "HTTP|content-type"

Source: Schmalbach’s original fetch traces and header dump; independently replicated by The Register, August 5, 2026.

What Was Actually Built

Per Mobian’s own documentation, the architecture is a CDN snippet on the publisher’s site. When a registered agent UA arrives, the request routes to the Mobian gateway, which fetches from origin, converts to Markdown, inserts the approved ad block at serve time, and returns the response on the publisher’s domain. Requests from unregistered agents fall through to normal serving. The design fails open: non-registered agents always get the original page.

The creative is a labelled block of cited brand facts, with the disclosure label on the first line. In the documented example — Ally Bank, placed on TIME’s Best Inventions of 2025 collection — the block contains three FAQ-formatted answers (“Who is Ally Bank?”, “Which banks offer early direct deposit?”, “Can you deposit cash at Ally Bank?”) with FAQPage JSON-LD and tracking links tagged campaign="ally-2026-q3". See the live example at Mobian’s spec.

The critical observation, on which everything downstream depends: those FAQ headings are not written for the reader who is currently looking at the page. Nobody browsing a “Best Inventions of 2025” list is being steered toward a checking account. The headings are written to match a future retrieval query, verbatim. The ad is not trying to influence the session it is in. It is trying to sit in an index until the right query arrives weeks or months later.

That distinction matters commercially. The placement pattern confirms it: Mobian’s inventory sits on evergreen list and section pages, not breaking news. That is not editorial preference — it is index-longevity as an inventory decision. A news story cycles out of retrieval fast. A best-inventions list sits in an index for years.

Source: Digiday, original report with Howard/Goodhart quotes; TIME + Mobian page; Mobian architecture overview.

Why This Is Not the llms.txt Problem

The obvious criticisms of agent advertising do not land here, and being clear about that is what gives the criticism that does land its weight.

Delivery is solved. No new fetch behaviour is required. The agent already wanted the page. Compare this with llms.txt, where Reboot’s controlled experiment — orphan pages discoverable only via llms.txt, on domains with confirmed bot activity — saw zero traversal visits in three months. The agent ad does not depend on a bot discovering a previously unknown file. It intercepts a fetch the bot was already going to make.

Inventory is site-wide. TIME reports that bot traffic now exceeds human traffic on most days. That is the total addressable inventory — every page on the domain, not one file. DataDome’s Q2 2026 report logged 17.7 billion AI agent requests in a single quarter. The volume exists.

Cannibalisation does not apply. The standard objection to brand recommendations — “if I recommend someone else, I lose the referral click” — assumes a referral product. This is not one. There is no traffic to lose because traffic was never the goal.

Cloaking liability was engineered around. Googlebot stays on the HTML path. The Mobian registry routes only registered assistant crawlers. Google’s indexing pipeline — and the ranking-signal liability that comes with it — never sees the Markdown fork.

Disclosure is handled honestly. The sponsorship label is the first line of the creative block. This is better disclosure hygiene than most native advertising.

Every single point above is a delivery solution. Not one of them is evidence of effect. The product solved the wrong problem with excellent engineering.

Index Persistence, Not Training

Most trade coverage conflates three distinct mechanisms when it talks about “influencing the model.” The distinction is not pedantic — it is the difference between a permanent global effect and a file sitting in a retrieval store that may or may not be consulted.

Table 2: Three crawler layers, three persistence regimes

OpenAI’s own documentation states that search indexing does not feed model training, and that robots.txt controls for each crawler are independent — you can allow OAI-SearchBot while blocking GPTBot. TIME’s configuration exploits this exactly. Training is explicitly excluded by the publisher’s own robots.txt.

This matters because the sales rhetoric describes Layer 1. Goodhart’s public framing: “When you influence ChatGPT, you’re influencing potentially all of ChatGPT. If ChatGPT changes what it says about a brand, it’s massive and it’s more than any one campaign could ever do.” That is a precise description of a training effect — permanent, global, beyond any single campaign, irreversible. The architecture delivers a document in a retrieval store that may or may not be consulted for any given query.

Nothing is learned. No weights change. A file sits somewhere and might get pulled.

Cross-session persistence is still real — a retrieval index is cross-session by definition, which is why this is different from llms.txt. But the gap between “your FAQ is one retrievable document among millions” and “you have changed all of ChatGPT” is where the entire valuation premium lives. That gap is the subject of the next two sections.

Sources: OpenAI bot documentation; GPTBot vs OAI-SearchBot analysis; retrieval-memory refresh windows.

The Retrieval-Path Problem

This is the section the trade coverage has skipped. Where does ChatGPT’s grounding actually come from? The answer is contested, and the contest is the point.

Three competing sources have been documented:

Bing dependency. ChatGPT Search retrieves substantially from Bing’s index. One 400-query replication study found the widely repeated “87% from Bing” figure is closer to 27%, and Bing’s top-3 URLs matched actual ChatGPT citations only 6.8–7.8% of the time. Source: AI Plus Automation replication.

Own index. OpenAI operates OAI-SearchBot and maintains its own retrieval index alongside the Bing partnership. This is the layer the Mobian ad targets. Source: Digital Applied pipeline analysis.

Google scraping. The Information reported that OpenAI uses SerpApi to scrape Google results, contradicting OpenAI’s public position that search relies on its own crawler, Bing, and licensed data. Source: Search Engine Land coverage of The Information report.

The decisive experiment already exists and deserves wider circulation. Quantable created a fictional company, submitted it only to Google Search Console, and observed ChatGPT’s knowledge of it one day after Google indexed the page. Critically: ChatGPT’s knowledge matched the SERP snippet in length and content, and it reproduced a truncated "per-" that appears in Google’s snippet but reads "per-organizational" on the live page. In that retrieval path, ChatGPT never fetched the actual page. It worked from the Google snippet. And Google is served TIME’s HTML, not the Markdown fork. The ad was not outranked or deprioritised — it was structurally absent from the pipeline. Source: Quantable canary experiment.

The fair caveat: ChatGPT’s architecture is almost certainly hybrid. The likeliest model retrieves from Google SERPs, Bing SERPs, OpenAI’s own index, and third-party data, then re-ranks across sources. Some fraction of grounding events touch the Markdown copy. But that fraction — the share of queries that route through OpenAI’s own index rather than through a SERP snippet — is the master variable of the entire business.

It is not knowable from outside.

The Valuation Model

Table 3: Agent ad valuation chain (stated priors; substitute your own)

That is a 1,350x spread. Per million billed impressions: 12 to 16,200 influenced answers. At a $15 CPM, cost per influenced answer runs $0.93 to $1,250.

You cannot distinguish a bargain from a catastrophe by a factor of a thousand. Every rate card in this category is a coin flip wearing a spec sheet.

# Agent ad valuation chain
# All probabilities are stated priors, not measured values.
# Substitute your own estimates; the model is the artifact.

stages = {
    "retention_in_store":    (0.30, 0.90),
    "retrieval_path_share":  (0.10, 0.50),
    "chunk_retrieval":       (0.02, 0.20),
    "citation_survival":     (0.10, 0.30),
    "answer_change":         (0.20, 0.60),
}

p_low  = 1.0
p_high = 1.0
for stage, (lo, hi) in stages.items():
    p_low  *= lo
    p_high *= hi

cpm = 15.0  # USD
impressions_per_million = 1_000_000

influenced_low  = impressions_per_million * p_low
influenced_high = impressions_per_million * p_high
cost_low  = (cpm / 1000) * impressions_per_million / influenced_high  # best case
cost_high = (cpm / 1000) * impressions_per_million / influenced_low   # worst case

print(f"Influence per impression: {p_low*100:.4f}% – {p_high*100:.2f}%")
print(f"Spread: {p_high/p_low:.0f}x")
print(f"Per 1M impressions: {influenced_low:.0f} – {influenced_high:,.0f} influenced answers")
print(f"Cost per influenced answer (${cpm} CPM): ${cost_low:.2f} – ${cost_high:.2f}")

Source: AirOps study via Erlin.ai (548,534 pages across 15,000 prompts; ChatGPT cites 15% of retrieved pages — anchoring stage 4).

The uncertainty contributions, ranked by spread:

Table 4: Uncertainty contribution by stage — where to spend diligence

The two unknowable stages are controlled by the same counterparty that sells competing inventory. That is not an allegation of bad faith — it is a structural description of the information asymmetry. OpenAI’s sponsored placements reached $100M in six weeks with a self-serve manager and no minimum spend (Segwise analysis). Every Mobian dollar is budget not spent in ChatGPT Ads. The party whose systems contain the unknowable variables has an incentive to keep them unknowable.

Critical Assumptions as Falsifiable Claims

Table 5: Assumptions underlying the product — audit against any vendor pitch

A4 deserves its own paragraph. Mobian chose legal-and-strippable over valuable-and-illegal. That is the correct ethical call — the disclosure design is better than most native advertising — and it is a severe commercial exposure. The <!-- mobian-agent-page --> comment, the x-mobian-* headers, and a “Sponsored content. Supplied in partnership with…” opener constitute a perfect classifier. No adversarial difficulty whatsoever. The disclosure that makes it lawful is the same string that makes it removable with a regex.

A5 has the only available empirical anchor. WARC and Charlie Oscar’s study, cited in Digiday’s buyer-skepticism coverage, found 63% of LLM brand visibility derives from long-term brand equity versus 26% from current marketing activity. An advertiser with strong pre-existing equity is buying a small increment at an unverifiable price. An advertiser with weak equity is buying a signal that sits below the noise floor of what the model already knows.

Sources: Media buyers debate, WARC/Charlie Oscar 63%/26% split; Digiday buyer skepticism.

The Measurement Is Circular, and That’s Documented

Mobian’s stated measurement methodology: feed the same FAQ questions contained in the creative to AI search engines and track visibility, favorability, and accuracy over time.

The ad contains “Who is Ally Bank?” answered in Ally’s language. The success metric is whether asking AI engines “Who is Ally Bank?” returns Ally-favorable content. That is largely true regardless of whether the ad exists — Ally is a large enough bank that its baseline brand equity already shapes retrieval. Selecting your test set from your own creative reliably manufactures a positive result without proving causation.

This is not an inference about hidden practice. It is the documented methodology. And the buyer-side critique, which Digiday itself reported, names the failure precisely: a placement that improves presence without improving accuracy or favorability may produce a positive dashboard while doing nothing for the buyer journey.

Digiday’s original report noted that no performance data has been published and it is not known whether LLMs treat these ads differently from editorial content or penalise promotional material. That absence of data, combined with a measurement design that cannot produce a null result, is the epistemic problem in its complete form.

Sources: Contentgrip on responsible test design; Relevant Audience critical analysis.

The Academic Literature Calls It an Attack

The closest thing to a controlled test of the underlying mechanism is “Illusions of Relevance: Arbitrary Content Injection Attacks Deceive Retrievers, Rerankers, and LLM Judges” (arXiv 2501.18536). This is the first empirical analysis demonstrating that injected content can mislead retrievers, rerankers, and LLM judges into treating non-relevant material as relevant, with systematic study of placement within documents and the ratio of relevant to non-relevant content. Code is available at github.com/manveertamber/content_injection_attacks.

Two things follow, and both matter:

The mechanism is empirically demonstrated. This paper is the best evidence for the product’s efficacy — it shows that non-relevant content, placed correctly, can be retrieved as relevant. The Ally Bank FAQ on a Best Inventions page is structurally the same as the injected passage in the paper.

The same paper evaluates defenses: adversarial passage classifiers trained to detect injected content, retriever fine-tuning to discount manipulated content, and cautious LLM-judge prompting. The defenses work, with effectiveness-recall trade-offs. The PoisonedRAG-class results — five crafted documents among millions achieving roughly 90% success in steering responses — sit in the same methodological family. Source: Vectra on PoisonedRAG.

The academic literature that validates the product simultaneously hands providers a defense playbook and classifies the technique as an adversarial attack. A provider’s ML safety team reading arXiv 2501.18536 reads a description of what Mobian does. The paper they then read for defensive options contains working countermeasures.

A companion threat-model paper treats advertisers as third-party adversaries in the web-agent threat model — not as market participants.

TTL Model: How Long Does This Last?

The following is a probability model with stated priors, not a prediction. Show the model; substitute your own assumptions.

Base rate: site reputation abuse. The closest structural analogue is Google’s site-reputation-abuse policy — third-party content hosted on a high-authority domain to inherit its trust signals, which is exactly what Mobian does for brands on TIME. The policy was announced March 5, 2024. First manual actions followed May 5–7, 2024. The policy was expanded in September and November 2024. Eighteen months on, it remains manual-action-only — the algorithmic version has not shipped. It nevertheless gutted the parasite SEO business model, pulled major publisher subfolders from rankings, and triggered an EU investigation in November 2025. Source: CapConvert 18-month review; Stan Ventures 2026 state-of-spam analysis.

Reading: material damage inside 12–18 months, without a fully automated countermeasure ever shipping.

Two adjustments pull in opposite directions.

Faster: The fix here is a regex or classifier on a self-identifying disclosure string, not a ranking-system rewrite. <!-- mobian-agent-page --> and x-mobian-impression headers constitute a perfect classifier. And the counterparty runs a competing ad business — every Mobian dollar is budget not spent in ChatGPT Ads.

Slower: Enforcement against parasite SEO stayed manual for two years because detection at scale is genuinely hard in the ranking context. Providers also have a reason to tolerate a labelled, factual, cited block — it is arguably better input than uncontrolled web text about a brand.

Table 6: Kill-vector probabilities (stated priors; 0.45 effective independence assumption)

With a 0.45 effective independence correlation haircut (these vectors share upstream drivers):

Median time to termination: ~19 months. Median time to loss of commercial credibility: ~10 months.

The gap between those two numbers is the finding. The product will very likely still be technically running long after it has stopped being defensible to buy. Demand-side collapse arrives first, because the measurement problem bites before any provider does anything. Advertisers will conclude they cannot prove it works roughly a year before anyone actually switches it off.

Three near-term calendar markers to check this model against:

September 15, 2026 — Cloudflare’s default configuration blocks Agent and Training crawlers from any page carrying advertising. Does an agent-ad-bearing page count as “ad-supported”? That factual question resolves within weeks of the date. Source: Cloudflare policy announcement via TechCrunch; Pay Per Use framework detail.

Next Google spam update cycle — 2026 ran roughly quarterly. Whether inauthentic-mentions or site-reputation-abuse language gets extended to agent-facing content after Google’s May 15 extension of spam policies to AI Overviews and AI Mode. Illyes directly compared paid inauthentic mentions to paid links. The language fits.

First provider response. Likely: OpenAI or Anthropic within two quarters, most likely as silent downweighting rather than a public announcement — which means you will only detect it by running a canary. Paid inclusion died as a result of FTC guidance two decades ago; the FTC Endorsement Guides point in the same direction for AI contexts. Note: this is directional, not legal advice.

Sources: Google site reputation abuse policy and blog post; June 2026 spam update; ChatGPT Ads launch details.

What a Buyer Should Demand

Any pitch for agent advertising inventory should be evaluated against five demands before a contract is signed:

1. Verified-agent impressions, not claimed. Cryptographic identity rather than UA strings — Web Bot Auth provides a model. UA strings are assertions; without cryptographic verification, “impression” means “a request that typed ClaudeBot in a header.”

2. A canary clause. A unique, unguessable token injected into the creative, plus a contractual right to test for its appearance independently across a 30–60 day window on sponsor-topic queries. A null result across a live campaign is publishable evidence that A3 fails. The arXiv canary-token methodology (2605.13706) provides the experimental design.

3. An off-topic control set. A set of test queries chosen before the creative is written and not drawn from the creative’s own headings, to test whether the placement produces any visibility lift that is not circular by construction.

4. A rotating holdout. Alternating on/off periods with a competitor control, so that observed answer changes can be attributed to the placement and not to baseline brand equity or seasonal retrieval changes.

5. Path disclosure, or pricing at the pessimistic end. If the seller cannot disclose the retrieval-path share — which they cannot, because the counterparty controls it — the price should reflect the pessimistic valuation ($1,250 per influenced answer) rather than the midpoint. Buying at $15 CPM without path disclosure is buying at the optimistic end of a 1,350x uncertainty band.

Sources: MediaCopilot buyer debate coverage; launch summary.

What Is Actually Durable

Two things outlive the ad product itself.

Token-denominated billing. x-mobian-tokens: 3323 is the first ad unit priced on the actual consumption mechanic of the channel rather than a borrowed human metric (pageviews, impressions, clicks). The token count is a real measurement of how much LLM processing budget the creative occupies. That idea — billing on tokens consumed — is structurally correct and survives whatever happens to the specific delivery mechanism. When an ad market for agents eventually finds its stable form, it will probably bill on tokens, and Mobian will have been first.

The verification gap. An ad market for agent traffic now exists, with a real ad server, a real publisher, and a novel billing unit. The only measurement available comes from the party being paid. Independent verification of agent impressions went from speculative to necessary in approximately a week. Ad markets need a trusted meter before they need inventory, and this one does not have one.

The Cloudflare Pay Per Crawl Discovery API and Web Bot Auth standard are building toward a cryptographic measurement primitive at infrastructure scale. Until that primitive exists — or until a neutral third party audits impression counts the way Nielsen audited television ratings — every rate card in this category is priced against an unmeasured variable.

The product solved delivery and called it effectiveness. Delivery was never the hard part.

External References

The primary story

• Schmalbach’s original fetch traces and header dump
• The Register, independent replication — August 5, 2026
• Digiday, original report with Howard/Goodhart quotes
• Mobian overview and specification
• Mobian Agent Ads detail
• Example ad unit (Markdown)
• TIME + Mobian partnership page
• Crawler simulator — Encited

Buyer reaction and skepticism

• Digiday — buyers skeptical of markdown ads
• Media buyers debate; WARC/Charlie Oscar 63%/26% brand equity split
• ContentGrip — what a responsible test should claim
• Relevant Audience — critical read on vendor-sourced stats
• MediaCopilot — launch summary

Crawler separation: training vs. index vs. live fetch

• OpenAI bot documentation — “search indexing does not feed model training”
• Independent robots.txt controls per crawler
• GPTBot vs OAI-SearchBot analysis
• Retrieval-memory refresh windows
• How ChatGPT fetches and renders pages

The retrieval path

• Quantable canary — GSC-only submission, SERP-snippet-limited knowledge, “per-” truncation
• Search Engine Land on The Information’s SerpApi report
• Ahrefs — citations diverge from Google despite scraping; hybrid re-ranking theory
• Bing top-3 matched citations only 6.8–7.8%; 87%-from-Bing claim replicates at 27%
• RAG pipeline and own-index architecture
• AirOps / Erlin.ai — ChatGPT cites 15% of retrieved pages
• Bing as gatekeeper discussion

Mechanism and adversarial framing

• Illusions of Relevance: arbitrary content injection deceives retrievers, rerankers, LLM judges (arXiv 2501.18536)
• Content injection attacks — code repository
• PoisonedRAG-class results overview
• Web agent threat model — advertisers as third-party adversaries (arXiv 2605.14290)
• Canary tokens across 22 production LLM systems, methodology (arXiv 2605.13706)

TTL base rates and policy

• Google site reputation abuse — 18 months in, still manual-only
• Search Engine Land — announcement timeline, March 2024
• Google developer blog — spam policies and site reputation
• Google spam policies reference
• Stan Ventures — seven spam updates, parasite model gutted, EU investigation Nov 2025
• Digital Hitmen — site reputation abuse policy explained
• Heroic Rankings — enforcement staging and loophole-closing pattern
• Google spam policies extended to AI Overviews and AI Mode, May 15 2026
• Illyes — inauthentic mentions compared to paid links
• Google June 2026 spam update
• Cloudflare September 15, 2026 default block — TechCrunch
• Cloudflare Pay Per Use monetisation framework
• Cloudflare Pay Per Crawl Discovery API
• Web Bot Auth / Pay Per Crawl launch
• FTC Endorsement Guides
• Paid inclusion history — Wikipedia

Competing channel and market context

• ChatGPT Ads 2026 guide — Segwise
• ChatGPT Ads format and labelling
• Ad density by category; single-answer trust risk
• DataDome Q2 2026 — agent traffic growth
• Fastly — AI traffic grew 6.5x faster than human traffic
• Cloudflare — bots pass humans in web traffic
• Pebblous — 71% of agentic traffic is browser-driven; UA filtering breaks

llms.txt contrast case

• Reboot controlled experiment — zero traversal visits in three months
• Limy — 408 of 515 million bot events reached llms.txt
• Evil Martians — two months of measured LLM traffic
• GEO paid mentions market — Search Engine Land