Pull to refresh
Logo
Daily Brief
Following Why Sign Up
Study of 217 million web responses finds AI-targeted instructions inside HTTP headers

Study of 217 million web responses finds AI-targeted instructions inside HTTP headers

New Capabilities

Websites are writing to AI agents in invisible header fields; most send pointers, a few try commands

Today: Findings reach a wide audience

Overview

Updated 1 hour ago

When a browser asks a website for a page, the server answers with a string of small header fields before the real content. Browsers show readers none of them. The threat research firm Signals Corps found that thousands of websites are now using those invisible fields to talk directly to AI agents.

In a scan of 217 million page responses from the Common Crawl archive, 7,959 sites sent a header written for an AI system. Roughly nine in ten pointed agents to files like llms.txt that list a site's AI-friendly resources. Thirty sites tried injection — header text meant to commandeer the agent. The numbers make HTTP headers a new, low-visibility channel for steering or attacking AI agents.

Why it matters

AI agents that fetch web pages may now take orders hidden in HTTP headers no human ever sees, and attackers are already testing the channel.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

7,959
Sites sending AI-directed headers
Sites in Signal Corps' scan that put a response header addressed to an AI agent.
30
Sites sending injection attempts
Header text meant to command the agent, most of it pranks in a header named X-AI.
217M
Page responses scanned
10% of the September 2026 Common Crawl archive, sampled by Signals Corps.
54.5%
Share of validated injections in headers
An academic scan of 1.2 billion URLs found most validated prompt injections rode in HTTP headers, invisible to DOM-only scanners.
32%
Rise in malicious injections
Google measured this relative increase in the malicious category between its November 2025 and February 2026 scans.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

Sarah Andrews
Sarah Andrews
Threat researcher at Signals Corps, author of the header-injection report
Led the scan and live agent tests published October 6, 2026

Organizations Involved

SC
Signals Corps
Threat research firm
Publisher of the October 2026 header-injection scan

Independent threat research team that measured AI-addressed text in web response headers.
GS
Google Security
Corporate security research team
Documented rising prompt-injection prevalence on the web

Published web-scale measurements of indirect prompt injection trends.
CC
Common Crawl
Nonprofit web archive
Data source for the scan

Nonprofit that runs regular crawls of billions of pages, available to researchers.

Timeline

2025 October 2026

6 events Latest: Today
Tap a bar to jump to that date

  1. Findings reach a wide audience

    Today Distribution

    Signals Corps' header-injection report becomes a top discussion on the Hacker News forum.

  2. Signals Corps scans 217 million responses

    Research

    Threat firm publishes a scan showing 7,959 sites send AI-targeted headers; 30 send injection attempts, mostly in a header named X-AI.

  3. Trackr analysis confirms header dominance

    Research

    Analysis of a web-scale corpus found 51.2% of validated prompt injections rode in HTTP response headers, where DOM-only scanners cannot reach.

  4. Academic study maps header injections

    Research

    The paper 'Indirect Prompt Injection in the Wild' counted 7,887 header-based injections across 6,394 webpages.

  5. Google scans show injection uptick

    Research

    Repeat scans between November 2025 and February 2026 showed a 32% relative increase in malicious prompt injections on the web.

  6. Anthropic tests Claude in Chrome

    Research

    Anthropic's Claude for Chrome testing found injection attacks succeeded about 1 in 9 times with mitigations in place.

Scenarios

1

Frameworks treat AI-directed headers as untrusted

Likely Resolves by Q2 2027

Discussed by: Signal Corps and its October 2026 Claude Code tests

Model vendors and agent frameworks decide that AI-addressed headers are untrusted input, shipped with director content, or stripped before fetching. October 2026 tests already showed Claude Opus, Sonnet, and Haiku ignoring canary headers by default, so hardening is a small step. The main variable is whether user prompts override the default, as they did in 7 of 9 test runs.

2

Header injection becomes a mainstream attack surface

Possible Resolves by End of 2027

Discussed by: Google Security blog

Attackers automate with their own agentic AI, and agents gain tools that can send data, move money, or run shell commands. Google expects both scale and sophistication to grow. Real-world harm would show up as credential theft, unauthorized transactions, or data exfiltration traced to header-carried instructions.

3

Header injection stays a sideshow

Possible Resolves by Jan 31, 2028

Discussed by: Academic measurements of injection objectives

Observed payloads are crude — reputation manipulation, bot identification, anti-scraping messages — and agents cannot act on them reliably. If fetch tools keep passing only page text, and frameworks keep ignoring headers by default, body-based injection remains the main threat and header attempts stay rare and harmless.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

1994

robots.txt convention (1994)

Webmasters began placing a plain-text file at their site root telling automated crawlers which paths to avoid. It became the near-universal machine channel for directing search-engine bots.

Then

Crawlers from every major search engine learned to read the convention within a few years.

Now

It set the pattern for sites issuing machine-readable instructions to bots, later copied by llms.txt and agents.md files.

Why this matters now

Today's x-llms-txt headers do the same job for AI agents. The difference: crawlers treated robots.txt as policy, while agents treat the pointer's destination as new, untrusted content.

August 2019

HTTP request smuggling (2019)

Researcher James Kettle published techniques hiding payloads inside HTTP headers so that intermediaries and backend servers disagreed about where one request ended and the next began.

Then

Major sites and CDNs patched parsing gaps over the following year.

Now

Established HTTP headers as a low-visibility channel that scanners and security tools frequently miss.

Why this matters now

Header prompt injections hide from DOM-only scanners the same way smuggling payloads hid from HTTP inspection tools, showing that what sits outside the rendered page still matters.

2000s

HTTP response splitting (early 2000s)

Attackers injected carriage-return and line-feed characters into header fields to split one response into two, letting them poison caches and run cross-site scripting through the header channel itself.

Then

Frameworks blocked CRLF injection after a wave of cache-poisoning attacks.

Now

Headered fields became a recognized injection surface with a defined, patched attack class.

Why this matters now

It is the closest precedent for attackers using an HTTP header as the delivery vehicle for a command aimed at a downstream interpreter — today that interpreter is an AI model.

Sources

(5)
Signals Corps arXiv Google Security Blog Trackr.Live SecurityBreak Blog