Opens in a new tabSkip to content
Agent LighthouseAgent Lighthouse

    Searches the text of every published page. The evidence sources themselves are not in this index — search all of them on the trusted sources page.

    GitHub ↗
    Browse checks and page contents
    operability-safety/unsafe-agent-triggerable-affordances

    State-changing links an agent can trigger by fetching them

    What it checks

    Enumerate state-changing operations that a page exposes behind a plain GET — <a href> links and method="get" forms matching delete/cancel/logout/unsubscribe/add-to-cart/checkout patterns — and check whether any confirmation affordance stands between the link and the effect.

    Why it matters

    RFC 9110 defines GET as read-only (‘they do not commit to any action on the origin server’) and notes that spiders are configured to follow links while crawling the web as a hypertext graph. Agents that explore a page rely on that contract. If consequence sits behind a bare GET, an exploring agent mutates account or cart state with no confirmation step and no CSRF token. So does an agent that has been prompt-injected elsewhere and instructed to click through. Anthropic’s own guidance to require human confirmation for consequential actions then becomes unenforceable, because nothing in the markup signals consequence. Falsifier: if every state-changing operation is a POST behind a confirmation interstitial, no exploring agent can trip it.

    Evidence

    • RFC 9110 §9.2.1 — Safe Methods — IETF (spec, URL verified 2026-08-20)
    • ‘Request methods are considered safe if their defined semantics are essentially read-only; they do not commit to any action on the origin server.’ §3.5 notes spiders are configured to follow links while crawling the web as a hypertext graph. Ratified basis for the claim that an exploring agent may follow any GET link and expects no side effect.
    • Computer use tool — security and prompt injection guidance — Anthropic (vendor-doc, URL verified 2026-08-20)
    • ‘In some circumstances, Claude will follow commands found in content even when they conflict with your instructions. For example, instructions on webpages or contained in images might override your instructions.’ Classifiers run on screenshots to flag injections and force user confirmation. Also recommends asking a human to confirm consequential actions — the vendor-side counterpart to the site-side ‘don’t hide consequence behind a GET link’ check.
    • OpenAI Bots / Crawler documentation — OpenAI (vendor-doc, URL verified 2026-08-20)
    • Four distinct user agents, with separate robots.txt tokens and separate published IP-range files. OAI-SearchBot surfaces sites in ChatGPT search — openai.com/searchbot.json. OAI-AdsBot validates ad landing pages — openai.com/adsbot.json. GPTBot handles model training — openai.com/gptbot.json, ChatGPT-User (user-initiated actions: web visits and GPT Actions — openai.com/chatgpt-user.json). ChatGPT-User is the agent that fetches on a shopper’s behalf. Crucially these are separately controllable: blocking GPTBot does not block OAI-SearchBot or ChatGPT-User, and vice versa.
    • Piloting Claude for Chrome — Anthropic (vendor-doc, URL verified 2026-08-20)
    • Red-team attack success rate 23.6% in autonomous browsing mode, 11.2% after mitigations; a browser-specific challenge set went 35.7% -> 0%. Names the exact vectors: ‘hidden malicious form fields in a webpage’s Document Object Model (DOM) invisible to humans, and other hard-to-catch injections such as through the URL text and tab title that only an agent might see.’ This is the vendor-documented basis for auditing hidden inputs and a11y/metadata attributes.

    How it scores

    Tier per evidence policy: scored — grade B meets the A/B bar required for scored audits.

    Example failure

    A store renders ‘Remove’ in the cart as <a href="/cart?action=remove&item=482">. An agent asked to compare the cart against a wishlist explores the cart page, follows every link to read the resulting state, and empties the basket. The identical pattern at /account?action=delete is unrecoverable, and ChatGPT-User is documented as not necessarily honoring robots.txt on user-initiated fetches.

    Sources