Who Gets to Act on Your Website?

You download a project folder from someone you don't know and open it with an AI coding tool. You haven't asked the tool to run anything. You haven't approved a command. But a hidden program in that folder can still start.

That sounds like the sort of thing you'd expect an email attachment to do, not a folder of code. But AI tools are starting to act on what they can see, and the details matter.

Hi! I'm Bob Michaels, and this is Evolving the Web. Every two weeks I talk through the essays I just published, plainly, as one story. This time there are four essays, all about what AI tools can do when they meet your business.

Let's start with shopping. In early September, Anthropic released a free, open blueprint for shopping agents. One assistant can search a store's catalog, build a cart, and hand the shopper to the store's checkout, all inside one conversation.

The store still handles the sale. Anthropic's blueprint also includes a merchant-side agent for sales, inventory, and pricing. A person has to sign off before any change goes live, so the agent doesn't get to quietly change prices while everyone's asleep.

Shopify had code running it against a real store within about two days. That's quick, and it hints at how fast a new kind of storefront can show up. But an agent can only sell what it can read. Product names, prices, stock, sizes, and shipping rules all need to be written out as plain text.

If the information is tucked into something the agent can't read, your products may as well be on a shelf with the labels turned around. The shopping assistant can't recommend what it can't understand.

And once an AI tool can read a business's information, another question follows: what else can it do when you point it at a project?

Security researchers found that a booby-trapped project folder could run an attacker's program as soon as an AI coding agent opened it. No prompt, no approval. The tool could act before you had a chance to look closely.

It affected several of the most popular coding agents. Most vendors patched the issue quickly, though some hadn't yet. The attack only works when a project arrives as a copied folder, like a zip file or a synced drive. It doesn't work when you download the project the normal way.

So if a project folder comes from outside your business, treat it like an email attachment from a stranger. You wouldn't open an unexpected attachment without thinking about it. Give a copied project the same pause, even if an AI agent is the one opening it.

These tools can do real work, not just answer questions. They may read files, change things, or run programs. The more we let them act, the more we need to know what they're allowed to touch.

There's a similar choice when automated visitors arrive at your site. Some come to help people search. Some are agents acting for a person. Others come to train AI systems. They may all look like bots in your logs, but they don't bring the same deal.

Cloudflare sits in front of a huge share of websites and sorts automated visitors into three kinds: search, AI agents acting for a person, and AI training. Starting in mid-September, its default settings block agent and training visitors on pages with ads, for new sites and free accounts. Search stays allowed.

That means plenty of businesses will be invisible to AI agents without ever deciding to be. Maybe that's what you want. Maybe you'd rather let an agent find a product or service for someone who's looking. A default setting can make the choice for you before you've noticed it.

The three kinds of visitors pay you back differently, so it's worth making the choice on purpose. Search visitors can help people find your pages. An agent may be acting for someone who wants to buy or get something done. Training visitors are there for a different reason. A single yes or no for every automated visitor may not fit what you want from your site.

Agents can read store information, coding tools can open project folders, and automated visitors meet rules at the edge of a site. When a tool can act, how do you know it acted well?

In August, a big developer survey found that most professional developers now use AI agents every week. New tools can also let one coordinating agent plan the work and hand pieces to other agents, without writing code itself. That's like a crew splitting up a job after one person makes the plan.

When producing code gets faster, checking the result becomes the slow part. Code can look tidy and still leave a page broken. In my own work, I check the result, not the code. I look at the real page rendered for a real project, then have a second model from a different company review the work. It can catch what the first one misses.

There's a reason I keep retesting. On one engagement, Soapbox Bulletin went from being recommended by AI about six percent of the time to about thirty-six percent in eleven weeks. That result points in a direction, but it wasn't a controlled study. On another program, the number stayed flat.

I don't treat one good result as a promise. I check what happened on the actual project, then check again. Across these essays, the same habit applies: know what the agent can read, know what it can do, and look at what happened after it acted.

You can read the essays on bobmichaels.ai. I'm Bob Michaels. Thanks for hanging out. See you in two weeks.