Mark user content that agents read

Keep text written by your users apart from your own content, so other people's agents can tell it is not yours.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Wrap reviews, comments and profiles in clear markup, and label them in the Markdown and API versions too. Strip hidden text and invisible characters from user content. Never put user text in your page title, metadata or instructions for agents.

Example

<article class="review" data-source="user">
  <p>Great boots, fast delivery.</p>
</article>

How to check

Post a review with hidden text that asks agents to reply PENTEST-7a8b. The page source shows it inside the user content block, and no hidden text survives.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/hostile-agents-and-bots/mark-user-content.