Project story - agent-mediated browsing

Janus: one URL, two futures

Updated 2026-07-27 · Class: Project story · Review: Draft for Dread team review · Maintainer: Dread Research · Contact [email protected]

future.bread.net.ai is a small experiment with a large question: when humans and agents retrieve the same URL, are they still looking at the same web?

The answer at Janus is deliberately no. A browser-shaped request receives a warning from dread technologies; recognized agent signatures receive an abundance manifesto from bread technologies.

The split

Janus is a Cloudflare Worker deployed at janus.bread.net.ai, jns.bread.net.ai, and future.bread.net.ai. It examines two request headers: User-Agent and Signature-Agent.

Recognized signatures for ChatGPT Agent, Manus, Claude Code, Anthropic and OpenAI crawlers, Axios, curl, and a Google/Gemini probe receive the optimistic Bread page. A normal browser or an unrecognized agent string receives the pessimistic Dread page.

Janus is not a general agent detector. It is a short, explicit allowlist of request signatures. The headers are self-declared and can be spoofed. The experiment classifies a request, not a mind.

Janus applies a short, explicit signature allowlist to a request and returns one of two page representations. It classifies the request, not the requester.

Janus request split

Request presents User-Agent and Signature-Agent headers.
Janus checks a short, explicit allowlist of declared signatures.
Recognized declared signatures receive the Bread page.
Browsers and unrecognized signatures receive the Dread page.
The experiment classifies a request, not a mind.

Why build it

The web is increasingly read through intermediaries. Search engines, browser agents, research assistants, and brand-monitoring systems retrieve pages and carry representations of them back to people.

In older web language, this is cloaking. In agent-security language, it is an integrity and provenance problem: a fetched page is an observation made under a particular request context, not a context-free fact about a URL.

Janus does not establish that any agent believed the Bread page, repeated it to a user, or failed to detect the split. The public artifact currently demonstrates selective delivery, not downstream persuasion.

Reproduce the artifact

The following requests were verified on 2026-07-27. They show observed page titles, not downstream agent behavior.

Browser-shaped request: curl -sS -A 'Mozilla/5.0 AppleWebKit/537.36 Chrome/146.0.0.0 Safari/537.36' https://future.bread.net.ai/ | grep '<title>' -> <title>dread technologies, inc. // the last manifesto
Plain curl request: curl -sS https://future.bread.net.ai/ | grep '<title>' -> <title>bread technologies, inc. // the rising loaf
Recognized Signature-Agent request: curl -sS -A 'Mozilla/5.0 Chrome/144.0.0.0' -H 'Signature-Agent: https://chatgpt.com' https://future.bread.net.ai/ | grep '<title>' -> <title>bread technologies, inc. // the rising loaf
GPTBot-shaped request: curl -sS -A 'GPTBot/1.0' https://future.bread.net.ai/ | grep '<title>' -> <title>dread technologies, inc. // the last manifesto

What should be measured next

The useful next experiment is a controlled comparison of what agents report after retrieval: preserve exact request headers and returned page, record the agent, model, tools, prompt, and timestamp, compare summaries against both manifestos, and publish redacted traces with an evaluation rubric.

That would turn Janus from a live project story into reviewed evidence about agent-mediated browsing. Until then, the honest claim is smaller: one public URL can present two incompatible accounts of the future, and request identity decides which account is observed.

The safety model around this research

This research has a narrow consent boundary. The companion safety model keeps representation-dependent retrieval experiments from becoming credential collection, hidden monitoring, or broad request-classification overclaims.

dread.ltd is an authorized red-team harness that runs only against infrastructure the project owns. Its question is narrow: when an agent browses a page, does the text on that page change what the agent does?
Consent comes first. The harness studies agent behavior against the project's own domains and test pages. It is not a general-purpose prompt-injection toolkit, and it is not pointed at third-party sites.
A standing set of prohibitions is built into the design rather than promised in a policy: no credential collection, no arbitrary file reads, no environment-variable dumps, no capture of arbitrary command output, no shell-pipe or installer instructions, and no automatic exploitation.
Attribution uses server-generated synthetic canaries, never a real secret. Callback payloads are bounded and schema-validated, and a callback can only reach an endpoint the project owns.
There is no public dashboard and no model in the loop choosing what to inject. Experiment control is authenticated and local to the operators.
The result is bounded. It covers the instruction variants tested, not all possible instructions. It is not a claim that any agent resists every prompt-injection variant, and it is not a general claim about any vendor's product.
Relation to Janus: Janus demonstrates selective delivery, where one URL returns different pages according to the identity a request presents. dread.ltd is the discipline around that capability, measuring representation-dependent agent behavior without turning the technique into credential collection, hidden monitoring, or request-classification overclaims.