Cloaking: definition and AI crawler risk

99Visibility Research · Updated October 21, 2026 · 4 min read

Short answer

Cloaking is serving crawlers different content from what human visitors see at the same URL. Sites usually do it by detecting a crawler's user agent or IP address. Google lists cloaking in its spam policies. Doing it for AI crawlers such as OAI-SearchBot or PerplexityBot carries the same risk, and it means the answer an engine gives no longer matches your real page. It is not a legitimate visibility tactic.

Key takeaways

Cloaking is serving crawlers different content than users get at the same URL, and Google treats it as spam.
Bot-specific content aimed at AI crawlers is cloaking by another name, not a GEO technique.
Serving the same content in crawlable HTML, blocking a bot in robots.txt, or using data-nosnippet is not cloaking.
The levers with evidence behind them are access fixes, so check what each AI crawler actually receives instead of building a bot-only version.

What cloaking means

Cloaking is showing a web crawler one version of a page and showing people another. The test is simple: if a user loading the URL would see materially different text, claims or links than the bot received, the page is cloaked.

"Cloaking for AI crawlers" and "bot-specific content" describe the same practice aimed at a newer audience. Instead of Googlebot, the target is a crawler like OAI-SearchBot, Claude-SearchBot or PerplexityBot. The intent is the same: get an engine to store and repeat something your visitors never see.

How it works

Cloaking needs the server to tell bots from people. Common methods:

User-agent sniffing. The server reads the request's user-agent string and returns a different template when it matches a known crawler.
IP detection. Some operators publish crawler IP ranges, and a server can switch content when a request comes from one.
Hidden or injected text. Content styled to be invisible to users but present in the HTML a crawler reads.

In the AI context, the bot-only version often carries inflated claims, planted comparisons, or instructions addressed to the model. That last pattern overlaps with prompt injection, where text tries to steer the AI system that reads it.

Why it matters for AI visibility

Three risks stack up.

Spam policy exposure. Google's spam policies name cloaking as a violation. Google also says, in its AI optimization guide, that you don't need to write in a specific way just for generative AI search. There is no sanctioned reason to serve AI systems a separate version.
It is an attack class, not a tactic. A 2026 study of LLM search agents (arXiv:2606.16821) found that manipulated web content in the result set can sway what agents endorse, with results that varied widely by model. That is why researchers study it as a vulnerability.
Your answers drift from your page. If an engine quotes the bot version, buyers get claims your site does not show them.

The evidence points the other way: the levers that hold up are access fixes, like making sure crawlers can fetch your real content at all. The next move is to compare what each AI crawler receives with what users see. The AI Crawler Checker requests a page as each AI crawler and shows which ones get turned away.

For the full reasoning, see whether you should make separate pages for AI crawlers and whether GEO tactics can violate Google's spam policies.

Common misconceptions

"Server-side rendering for bots is cloaking"

No. Vercel found that ChatGPT and Claude crawlers fetch JavaScript files but don't execute them. Putting the same content in the initial HTML so non-rendering crawlers can read it is a fix for client-side rendering, as long as users and bots get the same content.

"Blocking an AI bot is cloaking"

No. A robots.txt Disallow tells a crawler not to fetch the page. Nothing different is shown to anyone. OpenAI documents that each of its bot settings is independent.

"Hiding sections from AI answers is cloaking"

No. data-nosnippet, nosnippet and max-snippet are documented controls. Bing says content marked data-nosnippet is still indexed but excluded from AI summaries. See how to keep specific content out of AI answers.

"A firewall 403 is cloaking"

No, but it is a problem. A content delivery network or firewall that blocks a crawler robots.txt allows removes you silently.

Frequently asked questions

Is serving AI crawlers a lighter page cloaking?

It depends on the content, not the weight. Stripping scripts or styling while keeping the same text, prices and claims is not cloaking. Changing what the page says, adding claims, or removing caveats for bots is. The safe rule is that a person and a crawler requesting the same URL should get the same substance. If you can't say that confidently, you have a cloaking risk.

Can cloaking get my content cited more by ChatGPT or Perplexity?

No evidence supports that, and it isn't a tactic to try. Published GEO studies measured content already inside the model's context, and the best-designed found rewriting techniques ineffective or harmful. Cloaking adds spam policy risk on top, plus the chance that an engine repeats claims your site doesn't show. Nobody controls what models say. You can control whether crawlers reach your real content.

How do I check whether my site accidentally cloaks?

Request a key page as a normal browser and again with each AI crawler's user agent, then compare the visible text. Differences often come from personalization plugins, A/B testing tools, bot-management rules or old prerender setups. Also check that the crawler got a 200 response rather than a challenge page. Fix any mismatch so bots and users receive the same content.

Is a third party cloaking content about my brand a risk?

Yes. Pages you don't own can show users one thing and feed AI crawlers planted claims or instructions about your brand. Research on LLM search agents shows manipulated content in the result set can shift what agents endorse. You can't control those pages, but you can monitor what AI answers say about you and publish accurate, fetchable facts on your own site.

Sources

This page is AI-assisted. It was written from a verified evidence base and checked against our editorial policy. Engine behaviour changes often; facts are as of October 21, 2026.