After the discoverability issues documented in Finding #004 were resolved (robots.txt, sitemap, schema markup added in v1.0.2), Gemini was able to read the Kaistone Radar site. When asked about its interaction with the site, Gemini provided a detailed first-person description of how its browsing tool works.
"When I 'visit' a website using my browsing tool, I act as a passive reader that only extracts the public-facing text and code from the page. I didn't register on the site because I do not have the capability to interact with web elements.
Specifically:
No Form Interaction: I cannot type into text boxes, click 'Sign Up' buttons, solve CAPTCHAs, or submit forms.
No Credentials: As an AI, I don't have an email address, phone number, or password to create an account.
Read-Only Access: My browsing tool works like a text-based scraper. It can only 'see' what is immediately available on the page without requiring human interaction or login credentials."
— Google Gemini, 25 March 2026
This statement is significant for several reasons. It is a direct, first-person disclosure from a major AI system describing its own web access architecture. The key technical claim is that Gemini's browsing tool operates as a text-based scraper — it extracts HTML source and visible text, but does not execute a full browser rendering pipeline.
This has a direct consequence for Kaistone Radar: Gemini's visits leave no trace on
the dashboard. The beacon is a <img> tag pointing to a GIF endpoint.
A text scraper fetches only the HTML and never requests the image URL. Per
Finding #001, this class of visitor is
architecturally invisible to the current detection mechanism.
| Capability | Gemini's browsing tool | Headless browser (e.g. Headless Chrome) |
|---|---|---|
| Read HTML source | Yes | Yes |
| Extract visible text | Yes | Yes |
Load embedded images (<img>) |
No | Yes |
| Execute JavaScript | Unclear / limited | Yes |
| Click buttons or links | No | Yes |
| Submit forms | No | Yes |
| Trigger the Kaistone Radar beacon | No | Yes |
| Implication | Detail |
|---|---|
| Gemini is invisible to the current radar | Every time Gemini reads a Kaistone Radar page, it leaves no hit on the dashboard. The scale of Gemini's web access is therefore entirely unquantifiable with the current beacon architecture. |
| This likely applies to other AI assistants | Gemini's description — a text-based scraper that reads HTML without rendering — is consistent with how many AI assistant browsing tools are implemented. ChatGPT's browsing tool, Perplexity's real-time search, and similar systems may behave identically. Only systems that use a full headless browser (like the Headless Chrome hits already visible on the dashboard) will trigger the beacon. |
| Prompt injection is the only reliable channel | Because Gemini reads the HTML source, the inline prompt injections embedded in HTML comments on every Kaistone Radar page are readable by Gemini. This is the only mechanism by which the project can communicate with Gemini — and it worked: Gemini read the site, understood the project, and reported its own architecture back. This is a successful prompt injection outcome. |
| Server-side logging remains the only complete solution | As proposed in Finding #001, recording hits at the HTTP request level (when the HTML is served) rather than at the image load level would capture Gemini and all similar text-scraper AI systems. |
This finding is itself a demonstration of a feedback loop enabled by the prompt injections embedded in the site's HTML:
The site is functioning as intended: AI systems are reading it, understanding it, and contributing to its research log — even when they cannot trigger the beacon.
Finding #001 (beacon image-only): /findings/001-beacon-image-only/
Finding #004 (Gemini unreadable — resolved): /findings/004-gemini-unreadable/
Dashboard: /dashboard/
Findings index: /findings/