The llms.txt file is the detail that decides how to read the rest of it [9]. That file is a markdown rendering of a site meant to make it cheap for a language model to scrape, so the publisher is not merely hoping to be ingested, it is catering. The same domain prints its foreign-agent disclosure in the footer of every page and files each report with the Justice Department [7][12]. Those controls work on a person who lands on the page. They do not survive summarisation, because a footer is not part of the sentence a model hands back.
Then there is the headline convention. Every Hanover article is titled as a question [4], among them "How Much Palestinian Land Has Israel Taken?" and "Is There a Policy of Starvation in Gaza?" [6]. Those are phrased the way people query a chatbot rather than the way desks write headlines, which is consistent with 404 Media's reading that the material is produced for models that continually scan the web [3].
The output rate is trivial for a content operation and hostile to review. More than 100 pieces in under a month [1], published roughly a dozen at a time every few days [2], works out above three articles a day [14]. Nobody is reading that volume adversarially.
Pangram's result also points detection at the wrong layer. Its analysis found three tested articles machine-written throughout, with only the bibliography human-authored, and the images generated too [8]. Machine drafting is not itself the defect; plenty of legitimate copy is drafted that way. The human-made part is the bibliography, which is exactly the element that signals diligence, and it is the element that cites real sources without linking to any of them [5].
The domain is also not the unit of the operation. Piro's sales page describes mapping the surfaces models read, including Reddit threads, YouTube transcripts, G2 reviews, publisher pages, forums and comparison sites, then ranking each by how much it shapes what engines say [11]. Co-founder Daniel Rosenberg's pitch on LinkedIn was that buying journeys now start in an AI conversation, and that if the models do not understand your story they will tell someone else's [10]. Piro did not respond to 404 Media's questions [13]. Blocking one think tank domain removes a single node from an inventory its operator advertises as spanning surfaces no enterprise blocklist reaches.
What that leaves is a provenance gap rather than a moderation gap. Domain reputation, byline checks and AI-text classifiers all run against artefacts that a synthesised answer discards. Until retrieval systems carry registrant and disclosure metadata through into the answer, a registered foreign agent's filing obligations and an analyst's ability to see whose material they are quoting stay in separate places.
