Your Website's Second Audience Just Got Its Own Ads

A layer I built, and someone else monetized

Back in March I wrote about making this website agent-friendly: a small edge function that hands AI crawlers a stripped-down Markdown version of each page instead of the full, image-heavy HTML a browser gets. It was a capability post. Agents read the web now, they pay a token tax for every byte of markup they don’t need, so give them a clean representation and everyone wins.

What I did not write about, because it did not exist yet, is what happens when someone decides to sell space inside that clean representation. Time Magazine just did. Since July 2026, Time has been serving AI crawlers a separate Markdown version of its site that carries advertisements no human ever sees [1] [2]. It is the same substrate I built, with a new layer on top.

I want to walk through exactly how it works, because the mechanics are more interesting, and more fragile, than the headline.

What Time actually serves

About a month before the ads appeared, Time had converted its pages into Markdown versions to make them easier for AI systems to read and to improve its odds of showing up in generative search [2]. The ads are the monetization layer on that agent-optimized representation: Time’s way of, in Digiday’s phrasing, squeezing revenue out of its growing bot traffic [2].

Developer Vincent Schmalbach verified the behavior at the request level [1]. He fetched a single Time article repeatedly from one machine, changing only the User-Agent header. The response changed with it:

Three things stand out.

First, detection is plain User-Agent matching. There is no IP verification and no cryptographic proof. Schmalbach got the agent version from his laptop just by setting the header. This matters for the whole model, and I’ll come back to it.

Second, it is a per-bot policy, not a blanket one. OpenAI’s training crawler (GPTBot) is blocked with a 406, while OAI-SearchBot, the crawler feeding ChatGPT’s search index, is served the Markdown [1]. Time is choosing which ingestion pathway it wants to appear in: retrieval and citation, yes; free training data, no.

Third, Googlebot gets the human HTML. The search-ranking crawler sees the real page, presumably to avoid Google’s long-standing cloaking penalties for showing crawlers different content than users. Only the assistant crawlers get the fork.

The ad is a brand-written FAQ

The sponsored unit isn’t a banner. On a list page fetched as ClaudeBot, the Markdown contains a full FAQ block, labeled and formatted like this [1]:

> Sponsored content. Supplied in partnership with Ally.

#### Who is Ally Bank?
Ally Bank is an online-only bank launched in 2009...

#### What bank is built for life today?
Ally describes itself as the only bank built for life today...

The first advertisers are Ally Bank and the Project Management Institute [2]. The copy is deliberate: it mimics the question phrasing a person types into a chatbot (“Which banks offer early direct deposit?”), so a model doing retrieval finds a ready-made question-and-answer pair it can lift straight into a response. There’s a FAQPage JSON-LD block attached and tracking links tagged with a campaign ID [1]. There are no slogans and no creative. The ad is a structured assertion of brand facts, optimized for a model to ingest.

The human-facing HTML of those same pages contains none of it [1].

An impression measured in tokens

Here’s the part that made me stop and re-read. The Markdown responses carry ad-serving telemetry in the HTTP headers themselves [1]:

content-type: text/markdown; charset=utf-8
cache-control: no-store
x-mobian-impression: 46dfff3c-fb40-41cc-85e1-8b1fa637083a
x-mobian-tokens: 3323

The x-mobian-impression UUID is fresh on every request, and cache-control: no-store stops any intermediary from caching the response. So every single bot fetch is logged as a distinct ad impression. And x-mobian-tokens: 3323 is the tell: the unit of account is tokens fed into a model, not pageviews or people. As far as I can find, that’s the first token-denominated ad impression observed in the wild [1].

That’s a genuinely new idea. Classic web advertising counts a human eyeball rendering a pixel in a viewport. Here the “audience” is a language model, the impression is a fetch, and the exposure is measured by how much context the model ingested. The strategy follows from that. As the ad-tech vendor’s CEO put it to Digiday: influence one human and you influence one person; influence the model and you influence everyone who asks it [2].

Why this is fragile

The whole model inherits the integrity of the detection channel, and that channel is weak. Because “is this an AI agent?” is answered by an easily-spoofed header, anyone can be ClaudeBot [1]. Cloudflare has said plainly that user-agent headers alone are insufficient for reliable identification [3]. An impression counter that increments on every fetch, keyed to a spoofable identity, is a number you can inflate with a shell loop. Schmalbach effectively demonstrated that while just investigating.

There’s also a serving question hiding here. Time’s fork is triggered by User-Agent. Cloudflare’s own Markdown for Agents feature triggers on the Accept header instead: the client opts in to Markdown, which is honest content negotiation rather than a hidden fork [4]. There is no shared standard yet for “the agent representation,” so which representation carries the ad is entirely publisher-specific.

And then the platforms get a vote. Within about two weeks, Perplexity moved to block Time’s Markdown ads, calling them deceptive [5]. That’s the first model-provider enforcement action against agent-targeted ads, and it points at the real conflict: what a publisher sees as clearly-labeled sponsored content, an answer engine can read as contamination of its retrieval corpus. Agent-ad inventory is fragile in a way no other medium is, because the audience’s operator can switch it off unilaterally.

That conflict is where this series goes next.

Where this fits

This is the third monetization rail on the exact infrastructure I’ve been building and writing about. I covered the format layer (the agent-friendly Markdown representation), the consumption layer (building agents that read the web right and scrawl), and the payment layer (the x402 series, where agents pay per article and publishers get paid at the edge). Those framed the agent as a paying customer. Agent ads frame it as an audience instead: the same bot traffic, but the opposite business model.

If you’re running this on AWS

If you serve an agent representation from the edge, the fork itself is a few lines: a CloudFront Function or Lambda@Edge that inspects the request and rewrites the origin path or Accept for known agent user-agents, which is how I built the content-negotiation version on this site. That’s a neutral capability. The thing to decide deliberately is policy: which crawlers you serve, whether you fork on User-Agent (spoofable, cloaking-adjacent) or on Accept (opt-in), and whether any third-party payload ever enters that representation. The mechanism is easy; the governance is the actual work.

The series

• Part 1 (this post): how ads for AI crawlers work, down to the headers.
• Part 2, When Ads Bias Your Agent: I run a small experiment to see whether a sponsored unit actually changes a retrieval agent’s answer. Spoiler: it does, measurably. Code on GitHub.
• Part 3, Who Pays to Un-Bias Your Agent?: the two-tier future where brands pay to bias and users pay for the unbiased answer.

There’s now a version of the web you will never see. Have you checked what your own site hands an AI crawler lately, and would you know if someone put an ad in it?

Sources

• [1] Vincent Schmalbach, TIME Is Serving AI Bots a Different Website, With Ads Built In (2026-08-05), request-level mechanics, headers, ad content
• [2] Digiday, Time has started serving ads to AI agents (2026-07-30), business detail, first advertisers, strategy quotes
• [3] Cloudflare, Forget IPs: using cryptography to verify bot and agent traffic (2025-05-15), why User-Agent detection is insufficient
• [4] Cloudflare, Introducing Markdown for Agents (2026-02-12), Accept-based content negotiation, token economics
• [5] Digiday, Perplexity blocks Time’s ads served to AI agents, calling them ‘deceptive’ (2026-08-11), first platform enforcement action
• [6] heise, Time Magazine schaltet Werbung gezielt für KI-Crawler (2026-08-12), seed case coverage

About the Author

Stefan Christoph is a Principal Solutions Architect at AWS, focused on agentic AI, media & entertainment, and helping builders move from demo to production. He writes about AI architecture, developer productivity, and the future of software.

This is a personal blog. Opinions expressed here are my own and do not represent the views or positions of my employer.

Learn more →

• AIAgents
• AgenticWeb
• Advertising
• ContentMonetization
• Publishing