A brand paid to be in AI’s answers. Two weeks later, Perplexity called it deceptive.

On July 30, Digiday reported that Time had started selling ads that no human reader would ever see. The buyers were Ally Bank and the Project Management Institute. The audience was ClaudeBot, OAI-SearchBot, and PerplexityBot. On August 11, Perplexity announced it had blocked the whole thing from touching its index and warned that any publisher trying the same trick risked a “reputational downgrade” to its trust score.

Twelve days. That’s how long the first “ad for AI agents” survived before a platform treated it as spam.

Most of the coverage has framed this as a publisher story: can Time monetize bot traffic? That’s the wrong lens for anyone who runs a brand. The publisher took a fee. The brand took the risk. Ally Bank paid to have its name attached to a tactic that one AI platform now files next to cloaking, and OpenAI and Google haven’t said whether they agree.

What Time actually built

The mechanism, pieced together from Digiday’s original report, The Register’s testing, and a teardown by API Evangelist’s Kin Lane, works like this.

Time converted its pages to markdown in June. When a request hits Time’s CDN, the edge looks at who’s asking. A human in Chrome gets the normal HTML page. So does Googlebot, byte for byte. But ClaudeBot, OAI-SearchBot, PerplexityBot, and live user-triggered agents get a plain-text markdown document at the same URL, with YAML frontmatter, the article, and on some pages, a sponsored block.

The sponsored block is the product. Ad tech firm Mobian, founded by Moat’s Jonah Goodhart, writes it from a brand brief in FAQ format, gets the client to approve a PDF, and inserts it into the markdown with a comment tag () and a fresh UUID per impression for billing. Lane found the Ally unit contained a sponsored blockquote, definitions, markdown tables with sources, an FAQ wrapped in schema.org FAQPage JSON-LD, and tracked redirects to ally.com. The Register saw questions like “is Ally good for everyday banking” and “can you deposit cash at Ally Bank,” followed by the claim that Ally is “the only bank built for life today.”

Two details from Lane’s teardown stand out. First, on the pages carrying an ad, the sponsored block made up 41% to 70% of the document and sat above the journalism. Second, Time’s own llms.txt said Anthropic was disallowed, yet every Anthropic agent got markdown and ads anyway. The policy file and the CDN weren’t talking to each other.

Time’s COO Mark Howard told Digiday the site sees more bot traffic than human traffic on most days, and that Time gets more AI crawler requests than most of the roughly 7,000 publishers in TollBit’s network. Time sells one agent ad per markdown page, at a premium. Howard wouldn’t say what the premium was.

Why Perplexity called it cloaking instead of advertising

Cloaking, in the old SEO sense, means showing a crawler something different from what a person sees at the same URL. Google has penalized it for two decades. Time’s setup doesn’t trigger Google’s rule, because Googlebot gets the human page. But it triggers the same rule for every answer engine, because those crawlers get a document a human never sees.

Perplexity’s Chief Communications Officer Jesse Dwyer told Digiday the company works “continuously” to protect users from “deceptive advertising like markdown ads.” The objection wasn’t about labeling. Mobian’s own FAQ insists “the first line of every ad is a disclosure that it is sponsored,” and that’s true. The objection is that a label at the top of a block is worthless once a retrieval system chops the page into chunks.

Lane put it bluntly: disclosure at the top of a block does not survive chunking. Perplexity, ChatGPT, and Google AI Mode all retrieve passages, not pages. We covered this in our piece on how AI Mode raids pages for parts. If the retriever grabs the chunk containing “can you deposit cash at Ally Bank” and its answer, the “sponsored” line three paragraphs up doesn’t come along. What arrives at the model is a factual-looking Q&A, sitting on time.com, with time.com’s authority attached. The ad gets laundered into a citation.

That’s why Perplexity’s move is coherent even though it looks harsh. Perplexity killed its own ad business in February because, in its words, “a user needs to believe this is the best possible answer.” We wrote about the split between ad-supported and ad-free AI platforms at the time. A platform that gave up its own ad revenue to protect answer trust was never going to let a publisher sell that trust out the back door.

The advertiser is the one holding the bag

Think about what Ally Bank bought. It paid a premium so that, when someone asks an AI assistant about everyday banking, the model might have read a Time-hosted FAQ saying Ally is great for everyday banking. Reasonable enough on paper. Now trace what happened.

Perplexity blocked the sponsored blocks from its index, so the placement is dead on that platform. Perplexity also said publishers running markdown ads face trust-score penalties, which means the domain hosting the ad gets downgraded. If that reasoning extends to the brand named in the ad (and nothing in Dwyer’s statement rules it out), Ally paid for a negative signal. Meanwhile, OpenAI and Google declined to say whether they’d follow Perplexity, and Anthropic didn’t respond to requests for comment. Mobian’s public response says “a model can choose to use the information or not.” That’s true. It’s also the whole problem for the brand: the vendor can’t tell you which platforms are using it, which are ignoring it, and which are scoring it against you.

This is the same structural mistake as the “Summarize with AI” prompt-injection buttons Microsoft caught 31 companies using in February. In both cases a vendor sells a brand a way to influence AI answers that the brand’s customers can’t see. And in both cases a platform eventually finds it, names it, and the brands attached to it wear the label. Microsoft compared that episode to early-2000s SEO poisoning. Markdown ads are early-2000s cloaking with a YAML header.

There’s also the consumer side. Ipsos polled 1,085 US adults in January and found 63% said ads in AI search results would make them trust those results less. Hidden ads are a bet that users will never find out. Digiday found out in a week.

Mobian is half right, and the half that’s right is the useful part

I don’t think Goodhart is wrong about what models want. His defense is that AI systems “ignoring accurate, current, sourced brand facts will get facts wrong and lack real-time information.” Also true. The format Mobian built (short questions, direct answers, a table with sources, FAQPage schema, a definition block) is close to a textbook description of what earns citations. It’s the same shape we see in the pages that win in our own tracking.

Look at how much sourcing platforms actually do. Semrush’s 2026 AI Visibility Index, built on 126 million US prompts from January through April, found ChatGPT averages 15 sources per response and Gemini averages 3. A brand FAQ with clean answers and citations is exactly the kind of chunk a retriever wants. Mobian isn’t lying about that.

The problem is where the FAQ lives and who can see it. The exact same block, published on ally.com as a normal page that humans and bots both get, is legitimate content. Published on time.com in a layer only bots receive, it’s cloaked sponsorship. Same words, opposite treatment. The tactic didn’t fail because the content was bad. It failed because it was asymmetric.

The symmetry test

Every “get into AI answers” pitch your team hears this year should go through one question: does the human at the URL see the same thing the crawler sees? Run the current crop of tactics through it and the pattern is obvious.

Tactic	Human sees it	AI crawler sees it	How platforms have treated it
Brand FAQ on your own domain, in the HTML	Yes	Yes	Cited normally
Labeled sponsored content in a publisher’s HTML page	Yes	Yes	Disclosed native; no known penalties
Markdown-only sponsored FAQ (Time/Mobian)	No	Yes	Perplexity blocked it, threatened trust-score cuts
”Summarize with AI” button with hidden memory instructions	No	Yes	Microsoft flagged 31 companies as recommendation poisoning
Text hidden in white-on-white or `display:none`	No	Yes	Classic cloaking, penalized for 20 years

The three rows where the human sees nothing are the three rows that ended with a platform naming names. That’s not a coincidence. AI companies inherited Google’s spam team’s instincts, and Perplexity just showed they’ll act on them faster than Google ever did. Robert Webster, a former WPP executive quoted by Digiday, predicted the other LLMs will follow “to preserve their user’s trust.” I’d bet the same way.

What to do this week

You don’t need to wait for OpenAI to publish a policy. Four things, in order of how fast they pay off.

Audit your agency and vendor stack for asymmetric placements. Ask directly: is any of the content you’re publishing for us served only to AI user agents? “Agent ads,” “LLM-ready sponsored content,” “markdown placements.” Mobian told Digiday about 15% of brands already run markdown versions of their pages, so the vendor pitches are coming whether or not you’ve heard one yet. If a vendor can’t show you the placement in a normal browser, treat it as a liability.
Build the FAQ block anyway, and put it where everyone can see it. Mobian’s format is good. Steal it. Short question, direct answer, a sourced table, FAQPage schema, no puffery (“the only bank built for life today” is the kind of line a model will either ignore or quote with a raised eyebrow). Publish it on your own domain in the HTML page. If you want it on a third-party site, buy a normal labeled sponsored article that humans can read.
Check what your own site serves to AI agents. Time’s llms.txt said one thing and its CDN did another. Plenty of sites have a similar gap between what the marketing team thinks is happening and what the edge actually returns. Fetch a handful of your most-cited pages with the OAI-SearchBot, ClaudeBot, and PerplexityBot user agents and compare the output to the human page. Note that user-agent gating is leaky in both directions anyway: TollBit’s latest State of the Bots report found ChatGPT-User reached disallowed pages on nearly half of the European sites that had blocked it, because OpenAI says robots.txt may not apply to user-initiated fetches.
Watch for competitors running this play. The whole point of markdown ads is that you can’t see them in a browser. You can see the effect, though. If a competitor’s positioning line starts showing up verbatim in ChatGPT or Perplexity answers, and the citation points to a publisher page where that line doesn’t appear in the HTML, you’ve found one. That’s a monitoring job, and it’s exactly the kind of thing that only shows up if you’re tracking answers and citations across platforms, not just your own mentions.

The bigger lesson isn’t about Time. Bot traffic passed human traffic on the web this spring, as we covered when Cloudflare announced the crossover, and publishers are going to keep inventing ways to sell that audience. Some of those products will be fine. The ones that depend on the human never seeing what the machine sees will keep ending the way this one did, and the brand’s name will be in the headline every time.

RivalHound tracks your brand’s visibility across ChatGPT, Google AI, Perplexity, and more. Start monitoring to see where you stand.