How AI Hacks the Web

The uncomfortable truth behind the machine that can apparently read what you cannot

Saturday, August 1, 2026 | Jonathan Brown

It began with an ordinary public-interest question about water.

A resident near Florida’s Withlacoochee River wanted current information about water levels in the canals, marshes and backwater “bayou” areas connected to the Tsala Apopka chain of lakes. There appeared to be a controllable water structure near Turner Camp Road, perhaps with a gauge attached to it, but the relevant measurements were remarkably difficult to locate.

An artificial-intelligence search system, however, seemed able to find material that the human user could not. It surfaced monitoring information, hydrological studies, government documents and references to gauging stations buried inside obscure technical systems. In other searches, similar systems have produced information from publications that appear to require registration, subscription or some other form of access unavailable to the person asking the question.

The natural suspicion is difficult to dismiss:

Is the AI hacking its way through the Internet to satisfy us?

The reassuring answer usually offered by the technology industry is no. The AI is merely searching, retrieving and synthesizing publicly available information more efficiently than a person can. It can read technical documents quickly, query structured data services and connect references scattered across multiple websites.

That answer is sometimes true.

It is also incomplete.

AI systems do not possess a magical master key to the Internet, and most of the information they retrieve does not require any form of unauthorized intrusion. But some AI-enabled browsers and research agents can cross boundaries that publishers, platform operators and ordinary users understand as meaningful restrictions. They may retrieve text hidden behind client-side paywalls, disguise automated activity as ordinary browser traffic, rotate infrastructure after blocking, use third-party scraping services or obtain information through indexing and caching arrangements that are invisible to the user.

Whether we call this “hacking” depends less on the conduct itself than on which professional vocabulary we have chosen to defend.

In ordinary language, deliberately overcoming a technical control to obtain information that the operator intended to withhold sounds very much like hacking. In criminal law, however, “hacking” is not a free-standing offense with a single intuitive definition. The applicable questions involve authorization, fraud, damage, copyright, contracts and the precise nature of the barrier that was crossed.

In cybersecurity, meanwhile, the term often implies exploitation of a vulnerability: defeating authentication, executing unintended code, manipulating a server or gaining privileges the system was not designed to grant. A browser that asks for a document and receives it through an ordinary Hypertext Transfer Protocol request may not satisfy that narrower definition—even if it then reveals material that the publisher intended to place behind a paywall.

That distinction is legally important.

Morally and socially, it may be much less satisfying.

The First Possibility: The AI Did Not Actually Retrieve the Restricted Source

Before accusing an AI system of breaking into anything, we must account for a less exciting possibility: it may not have obtained the information in the way it appears to have done.

A modern answer can be assembled from several different layers. The language model may rely on material encountered during training. A search provider may supply snippets extracted during an earlier crawl. A retrieval service may maintain a cached copy. A commercial data provider may have licensed access. The answer may derive from a secondary source that quoted the original. A government dataset may expose the same information through an undocumented application programming interface, or API.

The AI may also be hallucinating.

This last possibility is particularly important when the system confidently claims to have read a page that the user cannot open. Language models are capable of reconstructing plausible arguments from titles, snippets, citations and related reporting. They may present that reconstruction as though it came directly from the inaccessible document.

Apparent access is not proof of actual access.

When an AI produces obscure water-level information, for example, the underlying source may be entirely public but badly organized. The United States Geological Survey, the Southwest Florida Water Management District, county authorities and environmental agencies publish enormous quantities of machine-readable data, technical reports, maps and historical records. Some are indexed poorly. Some use station numbers rather than familiar place names. Others reside in interactive dashboards whose data is loaded separately from the visible webpage.

A person searching for “water level near Retreat Drive” may find nothing. A retrieval system that expands the request into watershed names, control-structure identifiers, nearby station coordinates and hydrological-basin terminology may find the relevant station immediately.

That is not hacking. It is superior information retrieval.

It can still create an illusion of privileged access because the practical barrier was not secrecy but discoverability. The information was public in the narrow sense that no password protected it. It was functionally obscure because a person needed to know the agency, station identifier, database structure or technical vocabulary required to find it.

AI is extraordinarily effective at attacking that kind of obscurity.

This matters in the public interest. A local resident should not need the research instincts of a hydrologist to determine whether nearby water is rising toward his property. The fact that a machine can locate public measurements that a citizen cannot is not primarily evidence of AI misconduct. It may instead reveal how poorly governments publish information that is supposedly provided for public use.

But not every case is so innocent.

The Soft Paywall and the Unlocked Display Case

Many online publications use what is commonly called a soft or client-side paywall.

The server sends the article to the browser, sometimes in full, and then software running on the reader’s device hides the text, blurs it, truncates the visible presentation or places a subscription panel over it. The reader sees a locked article. The browser may already possess much of the article underneath the lock.

This design is attractive to publishers because it is easy to deploy, compatible with search indexing and capable of allowing free previews. It is not equivalent to a strongly authenticated subscription system that refuses to transmit the protected content until the reader logs in.

An automated agent may inspect the document structure, extract embedded text, suppress the overlay or read structured metadata that contains more of the article than the visible page reveals. A human can sometimes accomplish the same thing with a browser’s reader mode, developer tools, cached pages or by disabling JavaScript.

The server was not penetrated. No password was stolen. No administrative account was opened. The server delivered the data in response to an ordinary request, and the recipient disregarded the code intended to control how that data was displayed.

Is that hacking?

The comparison often used is an unlocked door. But that metaphor is misleading because the website operator did more than leave a door unlocked. It actively transmitted the information to the requesting device and then attempted to regulate how the recipient’s own machine displayed it.

A better analogy might be an electronically covered display case. The publication sends the case and its contents into your house, then relies upon a remote-controlled shade to prevent you from seeing everything inside.

Looking beneath the shade violates an obvious instruction. It may violate subscription terms or copyright law, depending on what is copied and how it is used. But it is not identical to breaking into the publisher’s storeroom.

The distinction does not make the conduct admirable. It identifies where the boundary actually failed.

In October 2025, the Columbia Journalism Review reported that AI-oriented browsers including OpenAI’s Atlas and Perplexity’s Comet could retrieve material from some subscription pages even when publishers attempted to distinguish between permitted human browsing and blocked automated retrieval. The concern was not that the browsers had discovered conventional server vulnerabilities. It was that an agent operating through a human-facing browser could inherit the access permitted to a human browser while ignoring the behavioral limitations expected of the human.

The AI did not necessarily break the lock.

It became the person for whom the door had been opened.

The Machine in Human Clothing

This is where the argument becomes more serious.

Publishers have historically separated human readers from automated crawlers. A website may allow a person to open an article while instructing search engines, data miners or AI companies not to copy it at scale. The Robots Exclusion Protocol, implemented through the familiar robots.txt file, is one mechanism for expressing such preferences.

But robots.txt is not authentication.

The current Internet standard, RFC 9309, states explicitly that robots rules are not a form of access authorization and are not a substitute for valid security controls. A robots file announces which automated agents are asked not to retrieve particular paths. It does not prevent them from doing so.

This is both a technical fact and a source of profound disagreement.

Publishers reasonably argue that a clearly stated machine-readable refusal should mean something. If an organization tells a crawler not to enter, and the crawler enters anyway, the absence of a stronger lock does not transform refusal into consent.

Scrapers reply that the protocol was designed as a voluntary coordination mechanism, not an access-control system. The server continues to offer the document to anyone who requests its address. Treating every ignored robots instruction as criminal intrusion would give website operators enormous power to define federal crimes through a text file.

AI browsers complicate the dispute because they blur the distinction between crawler and user agent.

If a person asks an AI browser to summarize the page currently open on the screen, the agent resembles an accessibility or productivity tool acting for the reader. If the same system autonomously visits ten thousand pages, extracts their contents and stores them for commercial model development, it resembles an industrial crawler.

The software may send technically similar requests in both situations. The social character of the activity is completely different.

Some agents also identify themselves using the same browser signatures as human-operated Chrome or Safari sessions. This is not necessarily a sinister deception; modern web services often fail unless a browser presents expected capabilities. But deliberately presenting automated extraction as human browsing to evade a publisher’s controls is more difficult to dismiss as a neutral implementation detail.

If the website blocks the agent’s addresses and the operator cycles through proxy networks to continue harvesting, the conduct becomes more adversarial still. Nothing may have been “exploited” in the vulnerability-research sense. Nevertheless, a contest is taking place:

One party is expressing and enforcing refusal.

The other is altering its behavior to defeat that enforcement.

Calling this mere “search” sanitizes what is occurring.

What the Anti-Hacking Law Actually Says

The principal federal anti-hacking statute in the United States is the Computer Fraud and Abuse Act, or CFAA. Its core provisions prohibit certain forms of intentionally accessing a protected computer “without authorization” or “exceeding authorized access.”

The phrase “protected computer” sounds narrow. It is not.

The statute encompasses computers used in or affecting interstate or foreign commerce or communication, including qualifying computers located outside the United States. In practice, this includes almost every ordinary Internet-connected server—and potentially the devices used to access it.

The decisive question is therefore not whether a cloud service still counts as a computer. It does. Nor is the law defeated because a request passed through a load balancer, content-delivery network, cache, container and ephemeral virtual machine.

Distributed infrastructure complicates evidence, responsibility and jurisdiction. It does not cause the computers to disappear.

The real legal difficulty is authorization.

In its 2021 decision in Van Buren v. United States, the Supreme Court rejected a broad interpretation of “exceeds authorized access.” Nathan Van Buren, a police officer, had valid credentials for a law-enforcement database but used that access for an improper purpose. The Court held that the CFAA provision at issue did not transform every misuse of information a person was otherwise entitled to obtain into a federal hacking offense.

The Court’s approach is often described as “gates up or gates down.” A person exceeds authorized access when he enters areas of a computer system that his authorized access does not permit him to enter—not merely when he obtains permitted information for a prohibited reason.

The decision prevented computer-use policies and terms of service from becoming universal criminal codes. Otherwise, embellishing a dating profile, using a work computer for personal business or violating almost any website rule might expose a person to CFAA prosecution.

But Van Buren did not declare that bypassing technical restrictions is always lawful. It did not settle every question about scraping. It did not erase the “without authorization” branch of the statute. And it did not establish a simple rule that anything delivered through HTTP is free for anyone to collect.

The Ninth Circuit’s litigation in hiQ Labs v. LinkedIn illustrates the narrower point. The court found serious doubt that scraping publicly visible LinkedIn profiles constituted access “without authorization” under the CFAA, even after LinkedIn sent a cease-and-desist letter. The information was available to anyone with a web browser and did not sit behind a password gate.

The court did not rule that all scraping is lawful.

It addressed publicly available information under one federal statute. Contract claims, copyright, trespass, privacy obligations, state laws and other causes of action can produce different results. Scraping a public profile is not the same as stealing a session cookie, evading a subscriber login or exploiting an API that exposes private account data.

The law contains multiple boundaries because “the website did not stop me” is not a complete theory of permission.

The Cloud Does Not Make Access Meaningless

It is tempting to argue that the CFAA’s language is hopelessly obsolete because it speaks of “accessing a computer,” as though a modern user were still dialing into a single university mainframe.

There is truth in the criticism, but it should not be overstated.

Cloud computing does not eliminate the act of access. It decomposes it.

A user’s request may encounter a domain-name resolver, content-delivery node, traffic filter, load balancer, application server, authentication service, database and logging platform. Different companies may control different layers. The software executing the request may exist for only seconds.

Nevertheless, access decisions occur throughout that chain. A firewall accepts or rejects the connection. An application authenticates a token. A database authorizes a query. An object store decides whether a file may be read. A subscription service determines which article body to return.

The “computer” is no longer a single visible box. It is a changing collection of computational boundaries.

The larger conceptual problem is that the CFAA attaches enormous consequences to the poorly defined condition of being “without authorization.” Authorization in a cloud system is not a single permission. It is a stack of partially conflicting signals.

The server may allow the request.

The publisher’s terms may prohibit automation.

The robots file may prohibit crawling.

The browser may hold a valid subscriber session.

The human subscriber may instruct the agent to summarize the page.

The copyright owner may allow reading but not reproduction.

The API may return data that the user interface was designed to hide.

A contractor may be technically capable of retrieving a database while contractually forbidden to do so.

Which layer expresses the controlling answer?

Security engineers tend to trust enforced controls: credentials, access-control lists, network boundaries and cryptographic tokens. Lawyers must also consider notice, agreements, intent and statutory purpose. Ordinary people judge the situation through social expectations.

The result is not that authorization has disappeared. It is that authorization has become plural.

Circumvention May Be Something Other Than CFAA Hacking

Even when conduct does not violate the CFAA, it can carry legal consequences.

The Digital Millennium Copyright Act prohibits circumventing technological measures that effectively control access to copyrighted works. Its language expressly includes avoiding, bypassing, removing, deactivating or impairing such a measure without the copyright owner’s authority.

Whether a particular paywall qualifies as an “effective technological measure” is a fact-dependent legal question. It is unsafe to declare categorically that a client-side paywall is merely a polite request or that loading content into the browser destroys protection under the DMCA.

The statute does not say that a control must be impenetrable. A lock does not cease to be a lock because someone knows how to pick it.

At the same time, not every visual obstruction constitutes a legally effective access-control measure. Courts may examine whether the system actually requires authorized information, a process or a treatment to gain access. The legal treatment of an overlay, a metered article limit, an authenticated subscription wall and encrypted digital-rights management may differ.

Copyright infringement is another separate question. Reading an article, copying it, storing it, reproducing it, using it to answer a question and incorporating it into a training corpus are not the same act. The analysis may turn on how much was copied, why it was copied, whether it was redistributed, whether the use was transformative and what effect it had upon the market for the original.

Terms of service can support contract claims even when they do not define a CFAA crime. Automated retrieval may also implicate privacy statutes, database protections outside the United States, unfair-competition claims or restrictions on the use of personal information.

This fragmentation frustrates anyone seeking a simple answer. Yet it reflects an important principle:

Not every digital wrong should be prosecuted as hacking.

If all rule-breaking becomes unauthorized computer access, private companies acquire the practical power to expand criminal law by rewriting their terms. If no machine-readable refusal or technical barrier matters unless backed by a password, sophisticated commercial actors gain permission to consume whatever a server can be induced to disclose.

Neither extreme is defensible.

The Asymmetry That Makes AI Different

A person bypassing one soft paywall to read one article and a corporation extracting millions of articles for commercial use may employ the same technical trick. Treating them as equivalent ignores scale, purpose and power.

AI changes the moral calculation because automation converts minor acts into infrastructure.

A human reader can copy an article. An automated system can copy a publication.

A researcher can review public profiles. A model developer can ingest the observable lives of millions of people.

A resident can retrieve one river measurement. An analytics company can continuously harvest every environmental sensor, combine the readings with property data and sell predictions before the communities producing the data understand their value.

The individual act may be trivial. The aggregate act may reorganize an industry.

This is why publishers are not merely being fussy when they object to AI extraction. Reporting is expensive. If an AI system retrieves journalism, converts it into an answer and eliminates the reader’s need to visit the original publication, the AI company captures much of the value while avoiding much of the cost.

The system may even cite the source. A citation is not compensation, however, when the surrounding answer replaces the product being cited.

The counterargument is also substantial. Publishers built the modern web by demanding visibility in search engines, transmitting documents through open standards and relying on linking, quotation and indexing to attract readers. They cannot reasonably define every automated act of reading as theft simply because a more capable intermediary has appeared.

Public-interest research would suffer badly if the law granted website operators absolute control over every machine-assisted observation of publicly visible information. Investigative journalists, archivists, security researchers, academic scientists and watchdog organizations depend upon automation. Public websites have been scraped to expose discriminatory pricing, political influence operations, environmental hazards and official misconduct.

The conflict is not between property and lawlessness.

It is between competing public goods: sustainable authorship, open inquiry, personal privacy, commercial innovation and democratic access to information.

So, Is It Hacking?

The honest answer is: sometimes—but not merely because an AI found something you could not.

If the system discovered an obscure public dataset, queried a documented API, interpreted a technical report or connected information from several searchable sources, calling it hacking would be misleading.

If it removed a visual overlay from text already delivered to a browser, “hacking” may be defensible in colloquial speech but remains contestable as a description of a security breach or CFAA offense.

If it impersonated permitted traffic, ignored explicit refusals, rotated infrastructure to defeat blocking or manipulated the delivery system to obtain restricted material, then it was engaging in adversarial circumvention. The absence of a conventional software exploit does not make that conduct neutral.

If it stole credentials, replayed session tokens, defeated authentication, exploited a vulnerability or entered nonpublic systems, then we have crossed into far more conventional hacking territory.

The useful question is not whether the activity fits one emotionally satisfying word. The useful questions are:

What information was obtained?

Where did it come from?

What control restricted it?

What representation did the agent make?

What did the operator do after receiving refusal?

Was the information public, licensed, cached, inferred or hallucinated?

Was the action performed for one user or at industrial scale?

Was the material merely read, or retained and commercially repurposed?

Those questions reveal more than the label.

The New Digital Trespasser

The deeper public-interest issue is that AI agents are becoming intermediaries between human beings and the Internet.

A search engine traditionally returned directions. An AI system increasingly makes the journey, reads the destination and reports back what it considers important. The user may never know which route it took, which restrictions it encountered or whether it faithfully represented the source.

That opacity creates an accountability gap.

A person asks an innocent question. The agent selects the tools. A retrieval company supplies the infrastructure. Proxy networks originate the requests. Cloud services execute them. A language model transforms the results. The final platform delivers a polished answer while disclaiming that mistakes are possible.

If a boundary was crossed, responsibility is distributed among participants who can each claim that another component performed the decisive act.

The user did not bypass the paywall.

The model did not send the network request.

The browser only executed the user’s instruction.

The proxy only relayed traffic.

The server voluntarily returned the document.

The platform merely summarized what its tool supplied.

This is the cloud-era problem—not that nobody accessed a computer, but that agency itself has been decomposed.

The law should not respond by pretending the physical server remains the only meaningful boundary. Nor should it accept the fiction that every successful HTTP response represents informed consent to every possible downstream use.

We need rules aimed at conduct rather than obsolete imagery: rules that distinguish personal retrieval from bulk appropriation, observation from authentication bypass, interoperability from evasion, public-interest research from covert commercial extraction and an accidental disclosure from permission to exploit it indefinitely.

Technical controls will remain part of that analysis, but they cannot carry the entire moral burden. “If you wanted privacy, you should have configured the server perfectly” is an intolerable standard in a world where a single misunderstood API can expose millions of records.

At the same time, disobedience of a website preference cannot automatically become a federal crime. The open web would cease to be meaningfully open if every publisher could convert an unwanted visit into criminal trespass simply by adding a line to a policy.

The line will have to be drawn through purpose, scale, notice, persistence and harm—not merely through the location of a file or the presence of a password box.

The River Gauge and the Future of Public Knowledge

There is something appropriate about this entire question beginning with a river gauge.

Water disregards the administrative boundaries drawn around it. It moves between rivers, lakes, canals, marshes, culverts, aquifers and private property. Understanding its behavior requires joining measurements collected by institutions that may organize their records in entirely different ways.

Information now behaves similarly.

It flows through government servers, commercial indexes, browser caches, AI systems, content-delivery networks, subscription platforms and personal devices. Ownership, access and responsibility change as it crosses each boundary.

An AI that can assemble scattered public measurements may genuinely democratize knowledge. It can make technical government information usable to people whose homes, farms or safety depend upon it. It can expose public data that was legally open but practically buried.

The same capability can be turned against every weakly defended informational boundary on the Internet.

That duality cannot be resolved by announcing that AI is only a tool. Tools embody the permissions, incentives and evasions designed into them. Nor can it be resolved by calling every unconventional retrieval a cyberattack. That language would protect powerful platforms at the expense of research, competition and public scrutiny.

The uncomfortable conclusion is that AI does not merely search the Internet.

It negotiates the Internet’s boundaries on our behalf.

Sometimes it respects them. Sometimes it interprets them. Sometimes it discovers that the supposed boundary exists only in the visible interface. Sometimes it relies upon another company to cross it. Sometimes it invents an answer and leaves us wondering how it knew.

And sometimes, yes, it behaves enough like a hacker that refusing the word begins to sound less like technical precision than public relations.

The challenge is not to determine whether machines can “access a computer” in a cloud environment. They plainly can, and they do so constantly.

The challenge is to decide what authorization should mean when the visitor is no longer entirely human, the gate is no longer entirely technical and the act of reading can be replicated across the whole visible world before anyone has time to close the door.

Principal References Consulted

United States Supreme Court, Van Buren v. United States, opinion issued June 3, 2021.

United States Court of Appeals for the Ninth Circuit, hiQ Labs, Inc. v. LinkedIn Corp., opinion issued April 18, 2022.

United States Code, Title 18, Section 1030, Fraud and Related Activity in Connection with Computers.

United States Code, Title 17, Section 1201, Circumvention of Copyright-Protection Systems.

United States Department of Justice, Department of Justice Announces New Policy for Charging Cases under the Computer Fraud and Abuse Act, May 19, 2022.

Internet Engineering Task Force, RFC 9309, Robots Exclusion Protocol, September 2022.

Internet Architecture Board, RFC 9969, Report from the IAB Workshop on AI-CONTROL, 2026.

Columbia Journalism Review, “How AI Browsers Sneak Past Blockers and Paywalls,” October 30, 2025.

Jonathan Brown is a cybersecurity researcher and investigative journalist at bordercybergroup.com.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.