38% of 2013's webpages are gone: new paper warns web-grounded AI is built on rotting evidence

• Who: Kim Jace (Jeong Hyeon), Ronin Institute for Independent Scholarship — the paper's sole author.
• What: The Vanishing Ground: Link Rot, Source Spoofing, and the Epistemic Fragility of Web-Grounded AI, a 75-page multidisciplinary narrative review.
• Published: October 18, 2026, open access on Zenodo (DOI 10.5281/zenodo.23444680), with a 529.8 kB PDF.
• The rot, measured: Pew Research Center (2024): 38% of webpages originating in 2013 were inaccessible a decade later; ~25% of a 2013–2023 sample is gone; broken links on 23% of news pages and 21% of government pages.
• Poisoning is cheap: Anthropic + UK AI Security Institute + Alan Turing Institute (2025): 250 malicious documents implanted a backdoor in 600M–13B-parameter models; Carlini et al. (2024): "split-view poisoning" exploits URL-based datasets when expired domains are re-registered by new owners.
• The proposal: judge AI answers by the availability, authenticity, temporal stability, and traceability of their evidence — and build source provenance, temporal verification, archival preservation, and retrieval integrity into a formal research agenda, including an "AI Evidence Survival Audit."

The AI industry spent this year teaching models to browse the web on your behalf — and this week, the web started slamming the door: The Verge reported Yelp, Delta, JPMorgan Chase, and Charles Schwab actively blocking agents from OpenAI, Meta, xAI, and others. A 75-page paper published today on Zenodo adds a quieter warning: even when an AI agent can reach a source, the source may be gone, altered, or never what it claimed to be. The Vanishing Ground: Link Rot, Source Spoofing, and the Epistemic Fragility of Web-Grounded AI, by independent researcher Kim Jace of the Ronin Institute for Independent Scholarship, argues that the reliability of web-grounded AI depends partly on the survival and integrity of its evidentiary environment — not solely on the capabilities of the model processing it.

A quarter of the recent web is already gone

The paper's starting point is a measurement, not a metaphor. It leans on a Pew Research Center study (Chapekis et al., 2024) of webpages sampled from 2013 to 2023: roughly 25% were no longer accessible, and the decay is worse for older pages — 38% of pages originating in 2013 were inaccessible a decade later. Broken links appeared on 23% of sampled news webpages and 21% of sampled government webpages. Jace's point is that link rot is the floor, not the ceiling: sources also change without notice, become inaccessible behind new restrictions, or get revised in ways that alter what an AI "read" when it cited them. For a system that retrieves evidence, generates an answer, and cites the evidence — retrieval-augmented generation, deep-research agents, AI search — a rotting evidence layer means the citation can outlive the source it points to.

Three ways the evidence fails

The paper organizes the threat into three interrelated vulnerabilities. Link rot and content drift is the passive one: digital decay quietly removes or mutates the evidence. Selective information disappearance is the political one: when records vanish unevenly — takedowns, policy-driven removal, platform decisions — the surviving record is lopsided, and Jace argues this creates "evidentiary asymmetry": whose history remains determines what an AI can conclude. Source spoofing and data manipulation is the adversarial one, and it spans the model's whole pipeline: poisoning training data, corrupting what retrieval surfaces, and deceiving agents as they execute multi-step tasks on the live web.

Poisoning is cheap, and attackers buy expired domains

This is where the paper stops being philosophical and starts citing receipts. A 2025 collaboration between Anthropic, the UK AI Security Institute, and the Alan Turing Institute found that 250 malicious documents were enough to implant a backdoor in language models ranging from 600 million to 13 billion parameters — triggered by a specific phrase, producing nonsensical output — challenging the assumption that a massive training corpus dilutes small amounts of poison. Souly et al. (2025) showed poisoning attacks need only a near-constant number of malicious samples. Carlini et al. (2024) demonstrated "split-view poisoning": datasets that store URLs rather than immutable copies of content are vulnerable when a domain expires and a new owner re-registers it — later users of the dataset retrieve whatever the new owner published at that address. Greshake et al. (2023) showed how indirect prompt injection crafts external content to hijack LLM-integrated applications. And the paper's reference list reaches into the news record: NewsGuard's 2025 reporting on a Moscow-based "news" network whose content infected Western AI tools, and a Columbia Journalism Review comparison that found eight AI search engines all bad at citing news.

Five scenarios to stress-test

To make the threat concrete, the paper walks through five attack scenarios: S1, silent removal that makes uncertainty look like consensus; S2, domain acquisition and source impersonation; S3, fabricated URLs and anticipatory domain registration (registering domains an AI is likely to hallucinate or trust); S4, citation laundering through repeated content — the same claim bouncing across sites until it looks corroborated; and S5, commercial reshaping of the evidence environment, where licensing deals and paywalls quietly decide which evidence survives in public. The paper's insistence throughout is that source unavailability and source falsity are different problems, and that technical susceptibility is not the same as demonstrated exploitation.

An audit for what AI stands on

The constructive half of the paper is a proposed research agenda: evaluate epistemic reliability not only by answer accuracy but by the availability, authenticity, temporal stability, and traceability of the supporting evidence. That means source provenance, temporal verification (what did this page say when the AI read it?), archival preservation, retrieval integrity, and systematic testing of how source changes affect generated outputs — culminating in a proposed "AI Evidence Survival Audit." Jace also draws explicit guardrails around the claims: this is a narrative review, not an incident report. It does not claim its scenarios have occurred at scale, assumes no coordinated campaign by any corporation or government, and says claims about intent, prevalence, and causation require evidence beyond a missing, altered, or inconsistent source. The central claim survives those caveats: a plausible, even accurate answer is not necessarily one whose evidence you can recover and check later — and AI evaluation should start accounting for that.