GPTBot Followed 8 Hidden Links in 14 Seconds. We Verified the IPs.

We placed links on our site that are invisible to human visitors. OpenAI’s GPTBot followed 8 of them in 14 seconds. TwitterBot and ClaudeBot followed none. We verified the IP against OpenAI’s own published ranges.

What we observed

On April 17, 2026 at 04:08 UTC, a crawler identifying itself as GPTBot/1.3 visited our network. In a single session lasting 51 seconds, it made 39 requests across our site.

8 of those requests were to links that are not visible to human users — elements styled with CSS properties that remove them from the rendered page. A human browsing normally would never see or click these links. GPTBot followed all 8 in a 14-second window.

This tells us something specific: GPTBot does not render CSS. It parses raw HTML and follows every <a href> it finds, regardless of whether the link is visible to a human user. It cannot distinguish between content meant for users and content that is intentionally hidden.

IP verification

We cross-referenced the source IP (74.7.241.x) against OpenAI’s own published IP ranges at openai.com/gptbot.json. The IP falls within the 74.7.241.0/25 prefix, which OpenAI explicitly declares as a GPTBot range.

This is not a spoofed User-Agent. This is not a proxy. This is GPTBot, operating from OpenAI’s declared infrastructure, verified against their own published data.

For contrast: TwitterBot and ClaudeBot

X Corp’s TwitterBot and Anthropic’s ClaudeBot visited the same pages on the same network during the same observation period. The same hidden links were present in the HTML.

Neither TwitterBot nor ClaudeBot followed any of them.

Same site. Same HTML. Same hidden links. Three crawlers from three major tech companies. Two skipped the hidden content. One followed all of it.

Why this matters

Hidden links are used across the web for various purposes: honeypots, bot detection, anti-scraping measures, and behavioral testing. A crawler that blindly follows all links in raw HTML — without evaluating whether they are meant to be seen by users — will trigger every trap, honeypot, and detection system it encounters.

This is not about intent. We are not claiming GPTBot is malicious. We are reporting an observable fact: GPTBot does not distinguish between visible and hidden content. Other major crawlers do.

Where GPTBot ranks

Below is the conduct leaderboard from our observation of 172+ bot operators, scored on multiple behavioral dimensions. GPTBot’s inability to handle hidden content contributes to its low ranking.

We contacted OpenAI at opt-out@openai.com on April 17, 2026 with a 48-hour notice before this report. As of publication, no response has been received. If OpenAI responds, this article will be updated with their statement.

The bigger picture

In our observation of 172+ bot operators, we found that the biggest names don’t necessarily have the most sophisticated crawlers. Some of the most well-funded AI companies operate crawlers that cannot distinguish visible content from hidden elements — a capability that smaller, less-resourced crawlers handle correctly.

This is Part 1 of a 5-part series. We’re publishing one finding per day this week.