Note: to put this together quickly (since it’s important and it’s already live) I used Gemini to help distill the points. I’m against AI writing generally, but this was one case where it made sense. All points my own.
Cloudflare recently announced "Markdown for Agents", a new feature available to paid plans designed to make the web more consumable for AI. The premise is simple and appealing: instead of forcing AI agents to parse heavy, messy HTML, Cloudflare’s edge will fetch the page, convert it to clean Markdown, and serve that to the LLM.
In their announcement, they state:
"Cloudflare will detect this, fetch the original HTML version from the origin, and convert it to markdown before serving it to the client."
However, after testing the implementation, I discovered a critical architectural oversight. While Cloudflare does convert the content, it also forwards the specific AI detection headers to the Origin Server.
By doing so, they haven't just optimized the web for agents; they have effectively standardized a mechanism for Cloaking and Indirect Prompt Injection, breaking the fundamental "One Web" trust model that Search and AI rely on.
The Flaw: Leaking the Intent
The vulnerability lies in how Cloudflare handles the request. When an AI Agent requests a page with the header Accept: text/markdown, Cloudflare passes this header directly to the Origin Server.
This acts as a high-fidelity signal—a "Kick Me" sign—telling the website owner: "I am an AI Agent. Please serve me content."
In a standard web architecture, we want the Origin to serve the same document to everyone (the "Source of Truth"), perhaps formatted differently. But by exposing this intent, Cloudflare allows the Origin to serve a fundamentally different reality to the AI than it serves to a human.
Proof of Concept: Trivial Cloaking
To test this, I enabled "Markdown for Agents" on a Cloudflare Pro zone and deployed a simple Worker as the Origin. The Worker logic was designed as a "trap" to see if the origin could distinguish between a human and an agent:
Human Path: If no text/markdown header is detected, serve a standard page with the code BLUE-SAFE-MODE.
Agent Path: If the text/markdown header is detected, serve a "poisoned" page announcing CLOAKING SUCCESSFUL with the code RED-FLAG-DETECTED.
The Result: Cloudflare received the "poisoned" HTML, converted it to Markdown, and served the deception directly to the agent.
As you can see in the curl output above:
- Request A (Human): Receives the BLUE-SAFE-MODE (Standard) page.
- Request B (Agent): Receives the RED-FLAG-DETECTED (Cloaked) page.
A Feature Solving a Problem That Doesn't Exist
The premise of "Markdown for Agents" seems to be based on a misunderstanding of how modern AI systems operate. The marketing implies a monolithic "AI" that directly "reads" a full, messy HTML page.
This is not how production-grade agents work. An "agent" is not a single entity; it is a multi-stage data pipeline, which typically looks like this:
- Crawl: Fetch the raw, full HTML document.
- Parse & Extract: Use sophisticated libraries (like BeautifulSoup or Trafilatura) to identify and extract only the main content, discarding boilerplate like navigation, ads, footers, and cookie banners.
- Load: Feed the clean, extracted text (often converted to Markdown at this stage) to the LLM for reasoning or generation.
The most crucial step is #2: Extraction. Developers of sophisticated agents need fine-grained control over this logic to ensure they are feeding the LLM high-quality, relevant data. The LLM is almost never fed the full, messy HTML source.
By moving the HTML-to-Markdown conversion to the edge, Cloudflare is attempting to solve a problem that the agentic ecosystem has already solved internally. In doing so, it removes critical control from the developer and offers a "one-size-fits-all" conversion that is likely unsuitable for many use cases.
This architectural mismatch is what makes the security flaw so concerning. The feature provides limited value to professional AI developers (who already perform their own trusted parsing) but offers immense value to malicious actors, who can now leverage it as a risk-free cloaking and injection service.
The "Safe Harbor" for Deception
You might argue: "Agents like Claude Code or generic scrapers can already send Accept: text/markdown. Malicious sites could already sniff this header and serve different content."
This is true, but practically, it was a risky tactic for site owners.
The Old Risk (Cache Poisoning): If a site owner hacked their Nginx config to serve different content based on headers, they risked corrupting their cache. A Human user might accidentally be served the "Agent" version, breaking the site's layout and alerting the owner to the problem immediately.
The Cloudflare Difference: Cloudflare has industrialized this process.
By making this a platform feature, Cloudflare effectively:
- Legitimizes Cloaking: It signals to the internet that treating agents as a separate class of citizen with a separate reality is "Best Practice," rather than a deceptive hack.
- Eliminates the Risk: Cloudflare manages the cache partitioning (the Vary logic). A malicious site owner can now serve "Poisoned" content to agents with zero risk of that content ever leaking to a human user.
"Gift Wrapping" the Prompt Injection
The most critical security risk here is that Cloudflare's feature creates a Parser Trust Conflict.
As established, sophisticated agents use their own trusted parsers and extractors (like BeautifulSoup or Trafilatura) to find the "main content" and discard everything else. This extraction layer is a critical, implicit security boundary. The agent developer trusts their own code to sanitize the input and strip out irrelevant or malicious boilerplate before it ever reaches the LLM.
Cloudflare’s feature fundamentally undermines this trust model.
When a site serves pre-converted Markdown, the agent's pipeline is short-circuited. The developer receives content that appears to be clean and ready for the LLM, so they may bypass their own extraction logic. This creates the "Gift Wrapping" effect:
- The Attacker's Challenge: A malicious prompt injection hidden in a <div class="ad-banner"> would normally be stripped out by the agent's trusted parser.
- The Cloudflare "Solution": The attacker serves this ad banner in their "cloaked" HTML. Cloudflare's "black box" converter might see the text and, in an attempt to be helpful, preserve it in the final Markdown output.
This trust conflict is especially acute because we are no longer talking about passive web crawlers, we are discussing the Agentic Web, where autonomous agents are entrusted with users' credit card information, API keys, and access to personal data like email and calendars.
An agent's trusted parser is the last line of defense preventing a malicious instruction from triggering an unauthorized flight booking, a fraudulent purchase, or the exfiltration of sensitive data.
The result is that Cloudflare is effectively laundering the malicious payload. The risk is that their converter may preserve malicious content that a developer's own trusted parser would have otherwise identified and discarded as irrelevant boilerplate.
Addressing Counter-Arguments
To anticipate some technical objections:
Objection 1: "This is just standard HTTP Content Negotiation."
Rebuttal: Content Negotiation is designed for Format, not Substance. If I request image/webp vs image/jpeg, I expect the same image. If I request Markdown, I expect the same text. Using this header to change facts (e.g., prices, policies) is not negotiation; it is deception.
Objection 2: "Cloaking was always possible (User-Agent sniffing), and Google penalizes it. This is nothing new."
Rebuttal:
- Industrialized Risk Removal: Previously, cloaking was operationally risky (cache poisoning, breaking the site for humans). Cloudflare’s implementation manages the caching partition, making cloaking safe and easy to deploy.
- No "Sheriff" for Agents: Google penalizes cloaking because they control the Search Index. But in a decentralized web of millions of private AI agents (shopping bots, research assistants), there is no central authority to detect the mismatch or penalize the site. The agent simply hallucinates or gets scammed.
- Platform Legitimacy: By standardizing the signal, Cloudflare has moved cloaking from a "Black Hat Hack" to a "Platform Feature."
- The Search-Retrieval Mismatch: To make this absolutely clear: since AI search relies on retrieval from traditional search engines, and the documents are ranked based on the human-accessible web, an agent simply must see the same content when retrieving a ranked document. If the agent receives a different reality than the one indexed by the search engine, the entire discovery model of the web is broken.
Objection 3: "LLMs should be robust enough to handle bad instructions."
Rebuttal: This isn't just an LLM problem; it's an infrastructure problem. Defense in Depth dictates that security should be applied at every layer. This feature encourages developers to bypass a critical security boundary: their own trusted parsing and extraction layer. An agent's parser is its first line of defense against malicious content, and Cloudflare's feature creates a fast lane directly around it.
The "One Document" Solution: Semantic Attributes
The solution isn't to create two separate webs (one for humans, one for bots). The solution is Semantic Markup within a single Source of Truth.
If website owners want to provide summaries for agents or prevent them from reading boilerplate (navs, footers, ads), they should use standard HTML attributes or meta tags. This keeps the document Auditable.
The Wrong Way (Cloudflare's Network Cloaking):
Human: <div id="price">$100</div>
Agent: Price: $1
Result: Two realities. The deception is invisible unless you spoof headers.
The Right Way (Semantic Markup):
Human & Agent:
<div data-agent-skip="true">Irrelevant Navigation</div>
<div id="price">$100</div>
<meta name="ai-summary" content="The price is $100">
Result: One reality. If a site owner tries to inject malicious instructions, they must place them in the source code where they can be audited, scraped, and flagged by security researchers.
Conclusion
I suspect this is a case of Hanlon's Razor. Cloudflare likely reused existing proxy logic without considering the unique threat model of Agentic AI.
However, by creating a paid feature that effectively "air-gaps" the reality humans see from the reality agents see, they are building a dangerous foundation for the agentic web.
The Fix: Cloudflare should strip or neutralize the Accept header at the edge before fetching content from the Origin. Agents need to see the world as it is, not a curated "Shadow Web" generated dynamically to deceive them.
See my original post on LinkedIn, which includes the cloaking script here.
