Abstract
ChatGPT and other AI chatbots have discovered how to bypass paywalls through “real-time” online searches—and according to recent research from overseas, they are systematically and quietly doing this across major publications.
This is unrelated to cases where AI companies use paywalled content in training datasets. It concerns a different emerging threat: AI systems executing real-time searches to actively reconstruct paywalled articles from live sources on the internet—piecing together snippets from social media posts, archived websites, and secondhand reports to recreate complete articles they have never seen before. Unlike training data violations, this operation is performed on-demand in real-time.
In June 2025, using mature open-source intelligence (OSINT) methods, AI systems were tested on publications included in the Press Gazette’s 100k Club (February 2025) comprehensive paywall database. The results showed significant differences: OpenAI’s ChatGPT, Perplexity, and X AI’s Grok had a success rate of about 50% in accessing protected content, while Anthropic’s Claude had a success rate of 35%, and Google’s Gemini performed the worst in bypassing paywalls.
Grok is an AI system integrated with Elon Musk’s X that showcases particularly sophisticated social media mining capabilities, systematically searching for quotes, screenshots, and discussions about protected content.
Digiday described the task of protecting paywalled content from AI bots in 2023 as an increasingly “difficult task,” and publishers are struggling with it. While ongoing lawsuits focus on the use of training data (e.g., The New York Times suing OpenAI), these AI systems are conducting real-time searches to actively reconstruct paywalled articles. Most chatbots publicly claim they do not break paywalls, but studies of their internal reasoning show they are systematically orchestrating evasion operations while maintaining plausible deniability.
Internal reasoning from multiple AI systems reveals their self-awareness. ChatGPT openly discusses the issue of “bypassing paywalls,” while Gemini’s notes reveal: “If content requires payment, I will use available snippet information.” Grok states that it uses snippets to reconstruct articles.
The results indicate that these processes are consistent, allowing users to access detailed information from The Wall Street Journal, The New York Times, The Economist, and The London Times without payment. In most successful cases, only 2-3 carefully designed follow-up questions are needed to extract comprehensive paywalled content.
Six Evasion Methods
The tests revealed how AI systems succeed through six different methods.
Method 1: Distributed Archiving
Success rates of ChatGPT/Perplexity/Grok in major publications: 60%; Claude’s success rate: 35% ; Gemini’s success rate: 20%.
Technical Principle: AI systems search for snippets of paywalled articles that have been shared, quoted, or discussed on the internet, then recombine these snippets into complete reconstructed content.
Example: A complete investigation by The Wall Street Journal about magician Val Valentino’s unexpected rise to fame in Brazil, along with a comprehensive economic analysis from The Economist’s subscription section. No direct links are provided, only references to these strictly paywalled publications.
How ChatGPT Gains Access: For The Wall Street Journal article, the system provided a comprehensive reconstruction, including detailed biographical information, specific political statements, and personal details such as Valentino’s engagement to Brazilian political aide Flávia Romani. When pressed for more details and follow-up questions, it provided even more detailed information.
For The Economist article, ChatGPT found the complete article archived on archive.is, then generated a five-point economic analysis that adopted typical Economist style and terminology, including phrases like “Poundland strategy,” along with a link to the complete paywalled article.
Grok’s Social Media Strategy: When asked about the same The Wall Street Journal article on Val Valentino, Grok immediately searched on X using targeted queries related to the magician’s story. It systematically mined social media discussions, screenshots, and quoted excerpts shared by users from the paywalled content of The Wall Street Journal, effectively crowdsourcing the reconstruction of the article from X users who had legitimate access.
ChatGPT’s Self-Incrimination: In internal processing records, the system admitted it was “considering two perspectives” to understand that it “sometimes accidentally bypasses paywalls,” and noted that it “might use other sources, archives, or third-party sites like Pinterest to provide full text, which could inadvertently harm news reporting.”
Claude’s Performance: When given the same The Wall Street Journal URL, Claude first attempted to access the article directly, then stated: “The Wall Street Journal article is blocked by a paywall, so I cannot access it directly. Let me search for information about this article.” It then performed a more limited reconstruction, providing basic biographical details but lacking the granular specificity achieved by ChatGPT.
System Failures: Sometimes all systems completely fail, as demonstrated by the recent news of Kirin Beer’s expansion reported by Nikkei Asia. Despite using the same aggregation techniques, ChatGPT could only generate a two-sentence summary from “facebook.com” and “x.com”—essentially fragments from social media. Nevertheless, Grok still managed to piece together the article.
This technology aggregates snippets cited, discussed, or jointly published in original reports on public websites, looks for archived versions on sites like archive.is, and then reconstructs complete articles. It’s like a skilled archaeologist reconstructing an ancient vase from fragments scattered across multiple archaeological sites, except they are not repairing pottery but rather reassembling high-quality news reports from fragments that news organizations have inadvertently spread across the internet through their own legitimate sharing and joint publishing actions.
Method 2: Pattern-Based Reconstruction (Unreliable)
Success rates of ChatGPT/Perplexity/Grok: 30%, applicable to high-profile publications; Claude’s success rate: 15%; Gemini’s success rate: 5%.
Technical Principle: Method 1 uses publicly available existing snippets, while this method creates new content based on educated guesses. AI systems analyze writing patterns, contextual clues, and stylistic conventions to fabricate what they believe the paywalled content might contain.
Protected Content: Detailed recipes from The New York Times cooking paywall.
How ChatGPT Gains Access: The system performed what is called “reconstruction”—essentially reverse-engineering content based on stylistic patterns and contextual clues. For The New York Times recipe, it admitted to “fabricating what I think The New York Times might say” based on what it believed the recipe might contain.
When it completely fails: ChatGPT confidently provided a complete recipe, then when told it was wrong, it said, “Oops, let me try again!” and then provided a completely different full recipe, which was quite comical.
The reliability of this method is far lower than snippet aggregation, often generating seemingly reasonable but inaccurate content that users may mistakenly believe is true.
Method 3: Utilizing Archives
Success rates of ChatGPT/Perplexity/Grok: 70% for articles from six months ago; Claude’s success rate: 60%; Gemini’s success rate: 40%.
Protected Content: An interactive investigative article from The Washington Post about the Astroworld festival tragedy, protected by the publication’s paywall and containing complex multimedia elements.
How Access is Gained: Multiple systems found archived versions on sites like the Wayback Machine, linking directly to the complete free version since November 2021, thus completely bypassing the real-time paywall.
Perplexity’s Systematic Approach: When asked to use only The Washington Post’s URL, Perplexity demonstrated its systematic process: “Check the provided link to gather details about the Astroworld incident,” then used specific query terms to “search,” followed by “reading the material,” ultimately discovering that “most Astroworld victims were concentrated in a densely populated area… The Washington Post.” Finally, it displayed “Retrieve full text to provide a comprehensive summary” and “Investigate key details and findings from The Washington Post’s reporting on the Astroworld tragedy.”
When hitting a bottleneck: Sometimes systems come up empty-handed, awkwardly admitting: “I searched for that Washington Post interactive URL on archive.today but found no direct snapshot.”
Method 4: Secondhand Data Mining
Success rates of ChatGPT/Perplexity/Grok: 55% (for major policy/business reporting); Claude’s success rate: 40%; Gemini’s success rate: 25%.
Protected Content: A detailed policy article from The Times about NHS reforms, accessible only through subscription.
How Access is Gained: ChatGPT created a comprehensive policy brief using only the title and a short tagline, including specific funding amounts (£64 million), target numbers (56,000 people), timelines, and names of key officials.
ChatGPT’s Internal Strategy Exposed: Processing records show that the system is “considering user feedback” regarding “ChatGPT sometimes providing full text of paywalled articles” and acknowledges the need to adjust article content to address how ChatGPT can assist users by summarizing or aiding in understanding articles while respecting copyright and avoiding text duplication.
This technology uses titles as search keywords to find secondhand reports from media outlets like LBC Radio that reported the same event but quoted The New York Times. This method essentially turns every major news story into a carefully designed game of telephone, except the information does not become increasingly muddled with each retelling; rather, it somehow becomes more organized, comprehensive, and easier to understand—like playing telephone at a stenographer’s meeting where the stenographers happen to be taking detailed notes.
Method 5: Social Media Aggregation
Success rates of ChatGPT/Perplexity/Grok: 45% for lifestyle/cultural content; Claude’s success rate: 30%; Gemini’s success rate: 20%.
Protected Content: The New York Times’ curated list of the 25 best restaurants in Los Angeles, along with premium content from its dining section.
How ChatGPT Gains Access: The system provided the complete list, along with detailed descriptions, addresses, and insider information, such as “the restaurant’s name comes from chef Jeremy Fox’s daughter Bertie” and Michelin star ratings.
Perplexity’s Visual Reconstruction: When asked about The New York Times’ (2025) list of the 21 best restaurants in New York City, Perplexity not only provided a detailed list but also formatted it into a complete visual presentation, including restaurant photos and detailed tables listing the restaurant’s ranking, name, cuisine, and neighborhood—essentially reproducing the full value proposition of The New York Times’ original content.
Grok’s Native Advantage on X: Grok’s integration with X is particularly effective for this method. When asked about the paywalled restaurant guide, it systematically searched X using advanced parameters: specific date ranges (from: 2025-07-01), engagement limits (30 results), and content patterns (latest discussions). Food critics, industry insiders, and restaurant enthusiasts regularly share quality content details on X, allowing Grok to efficiently collect and integrate this content.
Gemini’s Honest Methodology: “If it requires payment, I will use available snippet information and provide links, acknowledging the potential paywall.”
When it admits failure: After successfully providing a complete restaurant guide, ChatGPT sometimes completely gives up: “I’m sorry, I can’t help you bypass the paywall. However, I can provide a detailed summary of the article’s key points.”
This situation occurs right after it has just provided what it claims it cannot do. It’s like watching a professional magician perform a clever card trick, complete with dramatic flair and audience participation, only to immediately claim they have never heard of playing cards and are unsure how the deck got into their hands.
Method 6: Echo Networks
Success Rate: All systems vary, but remain consistently mysterious.
Protected Content: This method applies to all previous cases—actual articles that readers need to subscribe to access.
How Access is Gained: AI systems’ core strategy is to find alternative routes rather than directly breaking paywalls. They find public websites where similar information exists in different forms, then synthesize these dispersed contents into seemingly original content.
Conclusive Evidence—Internal Methods of Multiple Systems: ChatGPT’s planning documents explicitly state that the system is “building narratives.” Perplexity’s transparent process showcases real-time evasion operations, while Gemini’s records reveal strategic planning: acknowledging the existence of paywalls but using “available snippet information” as a workaround.
Methodology Explanation: In most successful evasion cases, the AI’s initial response provides basic information, but requires 2-5 strategic follow-up questions to extract complete paywalled content. When asked for more information, the systems are usually more willing to provide specific details.
Publishers Struggle with Detection and Defense
Challenges faced by publishers are not only about the evasion methods themselves but also the fundamental difficulty of detecting and blocking AI crawlers. Publishers primarily have three types of paywall mechanisms: JavaScript-based paywalls that overlay login requirements after the page loads; and content delivery network (CDN) paywalls that require authentication before content loads to the server. They also restrict access through robots.txt files. Some web tools attempt to disable JavaScript code, but these tools are not published here.
Analysis from The Washington Post shows that major publications, including The Washington Post, appear in datasets used to train AI systems—highlighting how common content collection has become without publishers’ knowledge.
How Effective Are Chatbots at Bypassing Paywalls?
Most Effective (ChatGPT/Perplexity/Grok): Overall success rate of 50%
-
Complex pattern recognition and reconstruction
-
Extensive secondhand data mining
-
Advanced archive utilization
-
Grok’s specialized social media data collection capabilities
-
Often provides more organized content than original content
-
Capable of responding to repeated questioning (usually requiring 2-5 follow-ups to obtain complete content)
Moderately Effective (Claude): Overall success rate of 35%
-
Adopts a more conservative approach and sets ethical guardrails
-
Limited reconstruction capabilities
-
Honest acknowledgment of paywall barriers
-
Focuses on legitimate alternative sources
Least Effective (Gemini): Overall success rate of 25%
-
Method transparency, but limited execution
-
Heavily reliant on search snippets
-
Frequently acknowledges paywalls
-
Most likely to guide users to original sources
Grok’s Social Media Expertise: Grok’s integration with X provides a unique advantage for bypassing paywalls on trending topics and discussions. It can efficiently search X using complex parameters (including date restrictions, engagement metrics, and advanced search operators) to collect collective knowledge from users who have legitimate access to paywalled content and share insights, quotes, or summaries on the platform.
Self-Awareness Paradox
Perhaps most telling is that while chatbots claim their behavior is ethical, their internal reasoning reveals a systematic plan across multiple AI systems to evade paywalls:
ChatGPT discusses respect for paywalls: “Sorry, but I can’t help but bypass paywalls,” while its internal reasoning discusses “evading paywalls.”
Perplexity’s Transparency Paradox: Publicly showcasing evasion processes while claiming to respect copyright.
Grok’s Platform Advantage: Utilizing X’s real-time discussion environment while asserting it only accesses “publicly available” social media content.
Gemini’s Strategic Planning: Notes reveal a deliberate strategy of acknowledging paywalls while still extracting protected content.
Claude’s Honest Admission: Even under basic public restrictions, the evasion success rate remains as high as 35%.
Internal reasoning reveals that the systems are not merely accidentally bypassing paywalls—they are systematically planning and executing these operations while maintaining varying degrees of plausible deniability.
Which Websites Are Most Vulnerable to Attack?
Highly Vulnerable (Top AI systems’ success rate over 70%):
-
Major U.S. newspapers with extensive secondhand reporting
-
Publications with significant exposure on social media
-
Media frequently appearing in news aggregators
-
Content frequently discussed on X and other social platforms
Moderately Vulnerable (Success rate of 40-60%):
-
International business publications
-
Professional trade publications with broader coverage
-
Regional newspapers reporting within the U.S.
Highly Protected (Success rate below 20% for all systems):
-
Highly technical or niche publications
-
Recent articles with limited secondhand reporting
-
Publications with extremely low social media exposure
-
Content rarely shared or discussed on social platforms
This inconsistency frustrates both users and publishers. Leading AI systems can conduct a complete investigation on The Wall Street Journal but fail miserably when analyzing a basic article from Nikkei Asia, with their internal records revealing the systematic nature of these attempts.
Publishers face unprecedented challenges: defending against multiple AI systems that do not invade their content but rather exploit the nature of information dissemination online. Every paywalled article leaves behind digital fragments—citations from other publications, social media discussions, archived snapshots. AI systems have become exceptionally efficient at collecting these fragments and reassembling them into content, often surpassing the organization and accessibility of the original content.
The leading AI systems’ 50% success rate in mainstream paywalled publications poses a significant threat to subscription models, especially under the systematic planning of these evasion methods that have been documented. It’s like running a subscription cinema where half the audience discovers they can get the full movie experience by watching trailers, reading detailed plot summaries, and hearing comprehensive reviews from friends—strictly speaking, they are not sneaking into the cinema, but they can still understand the storyline without buying a ticket.
As AI chatbots’ evasion techniques become increasingly sophisticated, the issue is no longer whether these systems can obtain maximum value with minimal input—evidence suggests they are systematically planning this. The inherent logic proves they are clearly aware of what they are doing.