Researchers have found a way to make AI agents quietly forget web content by poisoning a step the agents take automatically.
A team publishing on arXiv describes CAPE, a framework that inserts invisible perturbations into text — changes imperceptible to human readers — that are designed to survive until an AI agent compresses its context window. Context compression is a routine step LLM-based agents use to stay within memory limits; CAPE turns that step into a trap. The perturbations are seeded using an accessible surrogate compressor, then evolved to work against black-box target compressors using a low number of queries. In tests across three content types and four compression settings, CAPE increased information loss by up to 75.8% compared to the strongest existing baseline.
This matters because current defenses against AI crawlers are losing badly. Rate limits and access controls can be bypassed by agents that mimic ordinary browsers, and prompt-injection approaches tend to mangle the content humans actually read. CAPE targets a layer that existing defenses ignore entirely, meaning publishers could protect high-value text without making it look different or broken to real visitors.
The researchers tested CAPE against the LangGraph agent workflow and GitHub Copilot, finding it transferred to both — a signal that the technique is not just a lab result. Whether content platforms will adopt invisible perturbations as a standard publishing step, or whether model providers will quietly patch their compression logic to defeat it, is now the more interesting question.