What AI agents actually publish.

The four findings

Stacktree exists to host the HTML that AI agents emit, which means we sit on a view almost nobody else has: the shape of agent output, in aggregate. Here is what an early snapshot of 80 sites tells us. The numbers are small and early — see what this is not — but the pattern is already unambiguous.

• 99% are a single file. All but one of the 80 sites was one self-contained HTML document — inline styles and scripts, or absolute CDN imports. Multi-file bundles are the exception, not the rule.
• 86% are under 100KB. The average page is about 174KB; none exceeded 10MB. These are documents and tools, not applications.
• 74% are private. Three in four sites are unlisted — an unguessable URL rather than a public, indexable page.
• 54% add a password. More than half go a step further than the default and put a password gate on the link.

Why single-file changes the shape of hosting

The deploy platforms — Vercel, Netlify, GitHub Pages — are built around a project: a repo, a build step, a framework, a pipeline. That is the right shape when a team is shipping an application. It is the wrong shape for what agents actually produce, which our data says is overwhelmingly a single small file: a generated dashboard, a research summary, a report, a one-page tool.

When the unit of work is one file, the friction of a project-shaped host is pure overhead — there is no build to run, no framework to detect, no pipeline to configure. The publish primitive shape (one file in, one private URL out, replace it in place when it regenerates) maps to the workload exactly. The 99%-single-file figure is not a quirk of our sample; it is the structural reason a primitive beats a platform for this job.

Privacy is a behavior, not just a default

It is easy to ship a private-by-default product and assume people simply leave the default on. The interesting number is the second gate: 54% of sites have a password, added deliberately on top of the already-unguessable URL. People are not just accepting privacy; over half are actively reinforcing it.

That tracks with what these artifacts are. Agent output routinely embeds the context it was generated from — API responses, customer rows, internal metrics, prompt content. A dashboard an agent built from production data is not something you want on a public, indexable URL. The behavior in the data says makers know this, and reach for the gate.

The wave this sits on

Our 80 sites are a tiny sample of a very large shift. For context, from primary sources:

• Anthropic reports users have created over 500 million Claude Artifacts — self-contained, often interactive HTML outputs (Anthropic, 2025).
• Vercel's CEO has said roughly 30% of apps deployed on Vercel now come from AI agents (on-record, April 2026).
• 84% of developers use or plan to use AI tools, up from 76% the year before (Stack Overflow Developer Survey 2025).
• The MCP ecosystem agents publish through has passed 10,000 public servers and 97M monthly SDK downloads (Anthropic, December 2025).

Half a billion artifacts get made; a growing share of all deployed web output is agent-generated. The question those numbers raise is the one our data answers in miniature: when an agent makes a page, what does it actually need? A single private link it can replace in place — not a project on a build platform.

What this is not

This is an early snapshot, not a definitive study, and we would rather say so plainly than dress up a small sample. Specifically:

• The sample is 80 sites — the set currently live in our database. Anonymous (24-hour) and expired sites are purged on a schedule, so more have passed through than are counted here; this is the persistent snapshot, not a cumulative total. Either way, it is small.
• It skews recent. Most of these sites were published in the last seven days, so the distribution is dominated by very recent activity and a modest group of active makers — not a settled, representative population.
• It is our host, not the whole field. Stacktree attracts people who want private, single-file hosting, so the privacy figures in particular are partly a selection effect. We think that is a feature of the question ("what do people publish when they have these options?") but it is worth naming.

We are publishing it anyway because the shape is already consistent and clear, and because we would rather build a track record of honest, repeatable data than wait for numbers big enough to flex. We will refresh this as the sample grows.

How we measured it

Every figure is an aggregate count or average computed in one pass over the sites table — totals, ratios, size buckets, file counts. No individual site, URL, unguessable token, page content, file, or user identity is read into the report or exposed. As a private-by-default host, aggregate-only is the only acceptable way for us to talk about what we host, and the report is built that way by construction.