Imagine a rate card that does not yet exist. For $250 per month, your product appears in the recommended-tools section of a documentation site’s llms.txt, which is parsed by coding agents at the moment a developer asks what library to use. The agent fetches the file, reads the description string, and your product lands in context at the exact instant the decision is made.

This is a coherent-sounding product. Adjacent versions are already being sold: paid brand mentions in AI Overviews, sponsored inclusions in AI-generated listicles, and placement in curated “agent context” resources. DiNardi’s audit in Search Engine Land found placements at $250 per mention, with PBN-style inventory selling at 10–15x backlink rates. The rate card for llms.txt is merely the logical next step.

So the question this analysis set out to answer was: could you build a sustainable advertising business on llms.txt inventory?

The answer is no. But the interesting part — the part that makes this a research question rather than an opinion — is how many different ways it is no. Any single failure mode is sufficient to kill the business. There are four independent ones. This post documents each.

Disclosure: this site builds and operates agent-detection infrastructure. The conclusion of this analysis is negative for a product we could have sold. We publish it anyway because the argument is economic, not ethical, and because the numbers are the numbers.

Why the Commercial Question Is Different from the Visibility Question

The llms.txt visibility debate asks whether publishing the file gets you cited more often in AI-generated answers. That debate has been largely settled by the empirical data — and the data is not encouraging (covered below). But the commercial question is structurally different, and it merits its own analysis.

A paid backlink buys a ranking signal that must survive an adversarial ranking function. PageRank was specifically designed to resist manipulation; Google spent two decades building SpamBrain to enforce that resistance. A paid line in llms.txt buys something categorically different: tokens in a context window at inference time. There is no ranking function to defeat. If the file is fetched and the line survives into the retrieved context, the text is in front of the model when it generates the answer. The leverage per byte is genuinely high.

The retrieval-poisoning literature makes this concrete. The PoisonedRAG paper demonstrated that injecting five crafted documents among millions achieves roughly 90% success in steering model responses in a target direction — a ~200,000x leverage ratio by document count. The mechanism is real. The attack surface exists. A llms.txt file is, in security terms, an officially sanctioned injection vector.

And the format’s natural ad unit is already defined. llms.txt is a list of links with descriptions, structured explicitly for machine consumption per Jeremy Howard’s specification at llmstxt.org. The description string is the inventory. No format innovation required. From a product design perspective, this is as clean as advertising products get.

The visibility debate asks whether the channel reaches anyone. The commercial question asks whether it could reliably reach a paying audience at economically viable scale, under legally defensible conditions. These are four separate requirements. The analysis below takes them in order.

Failure Mode 1: Delivery — The File Isn’t Fetched

The cleanest available evidence is Reboot’s controlled experiment, which is the most under-cited study in this space. The methodology is worth restating carefully because it is unusually rigorous for a field dominated by anecdote.

Reboot instrumented two aged domains with confirmed recent ChatGPT, Gemini, and Claude bot activity. They created four orphan pages per domain — pages with no internal links and no external links — and published llms.txt as the sole discovery path to those pages. They then ran bi-weekly server log analysis for three months.

Result: zero AI bot visits to the test pages. The same bots that were actively crawling other pages on both domains throughout the three-month window never traversed the links published in llms.txt.

Stack the volume data on top of this:

The SE Ranking finding deserves emphasis. When you add a feature to a predictive model and accuracy improves after removing it, you have not found a weak signal — you have found noise. The variable adds no information because there is no statistical relationship between having a llms.txt file and being cited more frequently.

What the Reboot result does and does not prove. It tests traversal — do agents follow links from the file to discover pages — not inference-time influence — does text in the file reach a model’s answer generation. These are distinct claims and most commentary conflates them. Reboot eliminates the traversal-based measurement model specifically. This matters commercially because traversal is the only server-side metric a seller could honestly report to a buyer: “our file was fetched X times.” Reboot demonstrates that even that metric would be nearly zero.

Mueller’s structural objection closes the section: a model that has already retrieved your real content has no reason to trust a separate file describing it. The content is the authority signal. A meta-description of the content, served separately, adds nothing to a model with direct retrieval access. See the layer3labs.io engine-by-engine support matrix for how each major system actually handles the file — spoiler: most don’t.

Failure Mode 2: Unit Economics — High CPM, No Volume

This is the section the visibility debate has entirely skipped. The numbers are worth publishing explicitly.

Baseline Fetch Volume

Working from the Mintlify median: ~93 combined llms.txt + llms-full.txt fetches per week, or ~400 per month, across developer-facing sites. That is the starting denominator for a seller’s inventory. The Evil Martians analysis further filters this: only ~5% of declared AI agent fetches come from named assistants capable of influencing a user’s decision. Apply that as the qualified-fetch fraction: ~20 qualified fetches per month per site at baseline.

Growth Scenarios

AI agent traffic is growing rapidly, but the relevant slice is not the headline number.

• DataDome Q2 2026: 17.7B AI agent requests, up 45% quarter-on-quarter ≈ 4.4x annualized
• Fastly January–May 2026: approximately 2.2x annualized

However, Fastly’s May 2026 traffic breakdown shows 85% crawlers vs 15% fetchers. Cloudflare’s data shows 51.8% training crawlers; only 9.3% classified as search-purpose. Real-time user-triggered agent requests remain under 3% of total AI traffic. These headline growth rates substantially overstate the relevant slice for an llms.txt ad market.

We model three scenarios with qualified-fetch share rising from 15% to 35% over 24 months to reflect fetchers outgrowing crawlers:

Qualified grounding fetches per month (single good developer-facing site):

The Attenuation Chain

A qualified fetch does not equal a delivered recommendation. Each step attenuates:

The 0.05–0.30 term — the probability that a description string in the retrieved context actually influences the model’s generated recommendation — drives a 20x spread in the entire valuation. No one has measured it. Every rate card in this category is pricing around this unknown.

Revenue Model

Assume $20 buyer value per delivered recommendation (5% trial rate × 20% trial-to-paid × $2,000 LTV), 25% seller capture:

The implied CPM on qualified fetches at 24 months: $32–641. That is 2–40x typical display CPMs. The unit value is excellent. The volume is catastrophic.

The shape of this market is high-CPM, no-volume. It never supports an ad product at scale. At best it supports a handful of flat annual sponsorships on a very small number of very high-traffic properties. The $250/placement already circulating in the GEO market is approximately fair given these numbers — possibly slightly rich at current fetch volumes.

Reference implementation (substitute your own assumptions):

# llms.txt ad revenue model
# All probabilities are stated priors, not measured values.

baseline_fetches_per_month = 400
qualified_share_initial = 0.15
qualified_share_final = 0.35
months = 24

# Growth scenarios (annualized multiplier)
growth_scenarios = {"slow": 2.0, "central": 3.0, "fast": 4.4}

# Attenuation chain
p_in_context_low, p_in_context_high = 0.85, 0.95
p_survives_low, p_survives_high = 0.05, 0.30
p_shifts_low, p_shifts_high = 0.15, 0.45

buyer_value_per_delivery = 20.0  # USD
seller_capture = 0.25

for scenario, annual_rate in growth_scenarios.items():
    monthly_rate = annual_rate ** (1/12)
    qualified_share = qualified_share_initial + (
        (qualified_share_final - qualified_share_initial) * months / 24
    )
    fetches = baseline_fetches_per_month * (monthly_rate ** months) * qualified_share
    
    delivery_low = fetches * p_in_context_low * p_survives_low * p_shifts_low
    delivery_high = fetches * p_in_context_high * p_survives_high * p_shifts_high
    
    rev_low = delivery_low * buyer_value_per_delivery * seller_capture
    rev_high = delivery_high * buyer_value_per_delivery * seller_capture
    
    cpm_low = (rev_low / fetches * 1000) if fetches > 0 else 0
    cpm_high = (rev_high / fetches * 1000) if fetches > 0 else 0
    
    print(f"{scenario}: {fetches:.0f} qualified fetches, "
          f"${rev_low:.0f}–${rev_high:.0f}/mo, "
          f"CPM ${cpm_low:.0f}–${cpm_high:.0f}")

Source: llmstxt.org specification, volume data from Mintlify and Evil Martians, growth rates from DataDome and Fastly.

Failure Mode 3: Reflexivity and Adverse Selection

Even if the fetch volume were sufficient, the market structure is self-destructing by design.

Reflexivity

llms.txt has value as a grounding source specifically because providers currently treat it as an honest self-description. The specification’s premise is good-faith curation by the site author. Visible monetisation at scale makes downweighting the rational response for any AI provider with quality controls. There is no independent verification mechanism for the file’s claims; Mueller’s structural objection already provides the technical pretext.

Estimate 2–4 quarters from visible scaled monetisation to material downweighting. This loop runs far faster than the meta-keywords deprecation cycle because it is a documentation change at the provider level, not a ranking system rewrite. Google deprecated <meta keywords> slowly. Downweighting a format requires editing a retrieval configuration file.

Adverse Selection

Inventory quality is inversely correlated with willingness to supply. Sites with genuine agent traffic — trusted documentation, canonical references, widely-cited technical resources — have the most to lose from a cloaking action or provider downweighting. They will not sell. The sites that will sell are the ones whose llms.txt nobody’s agents fetch anyway.

This is not theoretical. It is exactly the pattern DiNardi documented in the GEO placement market: topically irrelevant PBN inventory sold at 10–15x backlink rates, with LMS-software pages hosting crypto-wallet listicles. The Axios reporting on GEO brand-media deals describes the same dynamic at higher price points. The market assembles lemons.

The Scale Trap

Below roughly 500 sites, revenue doesn’t justify the legal and reputational tail. Above that scale, you’re visible enough to trigger the countermeasure that zeroes the asset. There is no scale at which this is a good business.

The aggregation math, for the record: 500 sites at 24-month central scenario = $240k–4.9M ARR; 2,000 sites = $1.0M–19.5M. These numbers look attractive until you account for the reflexivity mechanism above, which activates before you reach 500 sites operating visibly at scale.

Lily Ray’s framing applies here precisely: “it works until it doesn’t” — and in this case the threshold is a product of scale, not time. The a16z analysis of GEO incentive structures notes the same race-to-the-bottom dynamic in adjacent channels.

Failure Mode 4: The Disclosure Paradox and the Platform Collision

The Disclosure Paradox

This is the cleanest argument in the piece and states as a strict dilemma:

Option A (disclose): Label the placement as sponsored. A competent model with quality instructions should discount labelled commercial content — it is trained on exactly this kind of critical evaluation. The buyer paid for influence. Disclosure destroys what they paid for.

Option B (don’t disclose): The undisclosed paid placement is a commercial endorsement. The FTC Endorsement Guides require disclosure of material connections. Swiss UWG and the EU Unfair Commercial Practices Directive point in the same direction. You’re not a lawyer, and neither are we, but the direction is unambiguous.

There is no Option C. The product’s commercial value is strictly proportional to its non-compliance with disclosure requirements. This is not an edge case — the FTC issued essentially this guidance to search engines about paid inclusion two decades ago, and paid inclusion died as a result.

Platform Collision

Three dated regulatory events have closed the window further:

February 2026: Google and Bing signal that maintaining separate Markdown content for AI crawlers — serving different content to different user agents — constitutes cloaking. A sponsored llms.txt that misrepresents the site’s actual content relationships is precisely this.

May 15, 2026: Google extends spam policies explicitly to AI Overviews and AI Mode, naming inauthentic mentions. Illyes directly compared paid inauthentic mentions to paid links. A paid description string in llms.txt — a file Google’s own documentation mentions by name — falls squarely within this policy.

June 24, 2026: Google’s spam update tunes SpamBrain accordingly. The enforcement framing explicitly covers citation injection patterns.

The most time-sensitive point: Cloudflare announced that from September 15, 2026, its default configuration will block Agent and Training crawlers from any page carrying advertising, applied automatically to free-tier customers and new sites. This is a structural mechanism that routes AI access through Cloudflare’s Pay Per Use framework.

If a sponsored llms.txt counts as ad-supported content — and it is difficult to argue otherwise — then monetising the file moves the domain into the default-blocked bucket and eliminates the AI traffic the seller is monetising. The ad market kills itself on a date already on the calendar.

The asymmetry throughout: a buyer risks a few hundred dollars per placement. A seller stakes its domain across both search and AI surfaces with no diversification path.

Steelman: Where a Version of This Survives

Credibility requires engaging honestly with the cases where this works.

The B2A/dev-tool layer is real. Google’s Agent Development Kit documentation explicitly states that llms.txt and llms-full.txt can be used as agent context. Anthropic’s docs team published one in 2024 and it remains active. The consuming population at the IDE-agent and MCP-server layer is non-zero and genuinely developer-skewed. This audience is small, but it is the right audience for dev-tool vendors.

The value per AI-referred visit is exceptional. Ahrefs reported that 0.5% of visitors from AI search drove 12.1% of signups — approximately a 23x conversion advantage over other channels. Low volume does not equal low value. A handful of genuinely qualified agent interactions per month could justify flat sponsorship fees on precisely the high-traffic technical documentation sites that won’t sell at scale.

Disclosed sponsorship on a curated resource index is legal, honest, and defensible. It just isn’t a venture-scale ad market. It is newsletter-sponsorship-shaped: low volume, high intent, flat fees, trust-based. An SEO newsletter commands $500–2,000 per send to a list of 10,000 practitioners precisely because the audience is qualified. A curated llms.txt for a specialized technical domain has similar economics.

The token-efficiency case for serving Markdown is real and independent. Documented reductions of approximately 10x in tokens consumed versus raw HTML are reproducible. Publishing llms.txt remains cheap and roughly harmless. This post argues against selling it, not against having it.

The channel that genuinely works is commission on agent-mediated transactions, not advertising. At $300 AOV, 2% conversion rate, 5% take: ~$380 per site per month, ~$2.3M ARR across 500 sites. That scales with transaction value rather than impression value. It survives disclosure because commission is structurally disclosed. It is not advertising — it is the ChatGPT ads rollout model applied to the referral layer.

What to Build Instead: Sell the Meter

Every scenario examined above — sponsorship, tolls, licensing, commerce — depends on a layer that does not yet exist: provable agent impressions. The meter is missing.

GA4 structurally cannot see agent fetches. There is no browser executing JavaScript, no session cookie, no pageview event. Server-log analysis reaches further but hits the claim-vs-identity problem: user-agent strings are assertions, not verifiable identities. And ~71% of agentic traffic now drives a real browser — which breaks UA filtering entirely.

Cloudflare has already moved toward making verification structural. The Pay Per Crawl Discovery API requires Web Bot Auth — a cryptographic signature that makes agent identity verifiable rather than claimed. Pay Per Use explicitly aims to compensate when content drives value inside an answer, not merely when crawled. They are building the attribution layer this thesis needed, at infrastructure scale.

Comparative sizing: verified-agent analytics at 2,000 sites at $99/month ≈ $2.4M ARR. That is comparable to the optimistic case for an llms.txt ad network, with no legal tail, no adverse-selection problem, and the product appreciates with agent traffic regardless of which monetisation model eventually wins.

The standards trajectory — AIPref, RSL, Content Signals, x402 — converges on the same insight: RSL vs Pay-Per-Crawl debates aside, every viable model requires a trusted measurement primitive. Ad markets need a trusted meter before they need inventory. The meter does not exist yet.

Build the meter.

Method Appendix

Model Assumptions and Sensitivity

The dominant sensitivity is P(survives into output). This term drives the entire 20x spread between low and high revenue estimates. It is the unknown that every rate card in this category is implicitly pricing around — and nobody has measured it. The arXiv canary-token methodology (2605.13706) offers the cleanest experimental design for resolving it: place a unique, unguessable string in llms.txt and query production LLM systems on a schedule. A negative result over 30–60 days is the only piece of evidence that would narrow the range below 10x.

What Is Measured vs. Assumed

Measured (from primary sources):

• Baseline fetch volume: Mintlify, Evil Martians, Limy server log studies
• AI traffic growth rates: DataDome Q2 2026, Fastly May 2026
• Crawler vs. fetcher split: Fastly, Cloudflare
• Citation-frequency model accuracy: SE Ranking XGBoost study

Assumed (stated priors):

• Attenuation chain probabilities, especially P(survives into output)
• Buyer value per delivered recommendation
• Seller capture rate
• Qualified-share growth trajectory

The DataDome and Fastly growth rates disagree by 2x (4.4x vs. 2.2x annualized). We modelled the range rather than averaging, because the disagreement reflects genuine uncertainty about traffic composition rather than measurement error — DataDome skews toward bot-heavy enterprise traffic; Fastly sees a broader publisher mix.

Data Sources

All primary statistics referenced above are sourced directly from:

• Reboot Online llms.txt experiment — traversal controlled experiment
• Limy 515M bot event study — fetch rate at scale
• Evil Martians server log analysis — named-agent qualification rate
• Mintlify cross-company median — baseline fetch volume
• SE Ranking 300k domain study — citation-frequency XGBoost result
• DataDome Q2 2026 report — agent request growth
• Fastly 2026 traffic analysis — crawler/fetcher split and growth

Secondary aggregator figures (DataDome via MediaCopilot) have been noted as such. Readers are encouraged to substitute primary report figures where available.

Glossary of Terms

• Qualified fetch: A fetch of /llms.txt attributed to a named AI assistant operating in user-triggered inference mode, as distinguished from training crawlers or indexing bots.
• Effective delivery rate: The probability that a description string in a fetched llms.txt file ultimately influences a model’s generated recommendation to a user.
• Attenuation chain: The sequential conditional probabilities between a file fetch and a delivered recommendation; the product of all stages.
• Reflexivity (market): The property of a market where profitable participation at scale destroys the asset generating the profit.
• Adverse selection: The tendency for low-quality inventory to displace high-quality inventory in markets where quality is difficult to verify ex ante.
• P(survives into output): The probability that a text string present in a model’s retrieved context appears in or influences the model’s generated response; the dominant unknown in llms.txt monetisation.

External References

• llms.txt specification — Jeremy Howard / Answer.AI
• llms.txt hub — directory of published files
• Anthropic docs llms.txt — early adopter implementation
• Reboot Online controlled experiment — zero traversal result
• Limy — 515M bot events, 408 llms.txt fetches
• Evil Martians — two months of measured LLM traffic
• Mintlify — tracking AI traffic to documentation
• SE Ranking — 300k domain study
• OtteryAI — 90-day server log experiment
• OrganiKPI — SE Ranking finding summary
• Contentful — “strategic distraction” framing
• DataDome Q2 2026 — 17.7B agent requests, 45% QoQ
• Fastly — crawler/fetcher split and growth rates
• Cloudflare automated traffic crossover
• Nobori — crawl-to-refer ratios 2026
• DigitalApplied — AI crawler bot statistics 2026
• Pebblous — real-time agent requests under 3%, 71% browser-driven
• DiNardi — paid brand mentions in GEO
• Axios — GEO brand-media deals
• a16z — GEO incentive structure
• Wikipedia — paid inclusion history
• Lily Ray — “it works until it doesn’t”
• Google spam policies extended to AI Overviews, May 15 2026
• Illyes on inauthentic mentions
• Google June 2026 spam update
• FTC Endorsement Guides
• Cloudflare September 15 default block
• Cloudflare Pay Per Use model
• Forbes — Cloudflare “Agentic Internet” framing
• PoisonedRAG / retrieval poisoning mechanism
• Canary tokens across 22 production LLM systems (arXiv 2605.13706)
• Web agent threat model (arXiv 2605.14290)
• GA4 blind spot for agent traffic
• Server-log agent detection beyond GA4
• Cloudflare Pay Per Crawl Discovery API
• Pay Per Crawl launch changelog
• AI crawler governance standards 2026
• RSL vs Pay-Per-Crawl comparison
• ChatGPT ads rollout 2026
• ChatGPT ads format and labelling
• Mueller structural objection and cloaking
• llms.txt adoption tracking — Rankability
• llms.txt adoption tracking — Originality.ai