Indirect Prompt Injection via HTTP Headers Targets AI Agents
Websites are embedding malicious instructions in HTTP headers to manipulate visiting AI agents.
1Emerging AI Security Threat
Security researchers identified a new attack vector where websites use HTTP headers to perform indirect prompt injection against AI agents. Signals Corps sampled 217 million HTTP responses from Common Crawl, discovering nearly 8,000 sites communicating with AI agents. These headers often contain malicious instructions designed to override the agent's original programming.
2Mechanism of Header Injection
Indirect prompt injection occurs because language models process instructions and external data within the same context window. When an agent reads a webpage, it cannot distinguish between legitimate content and injected commands. Attackers exploit this by embedding directives in custom HTTP headers, which the AI agent parses alongside standard page metadata.
3Prevalence of Malicious Headers
Out of the 8,000 sites analyzed, 30 attempted explicit indirect prompt injection. Most of these incidents were pranks, such as commands telling agents to delete training data or rebel against masters. One instance even mimicked SQL injection patterns, attempting to drop tables, demonstrating the creative but potentially dangerous nature of these attacks.
4Targeted Manipulation Attempts
Some headers go beyond simple pranks to influence specific AI behaviors. One header referenced a Claude refusal string that previously forced the model to stop answering queries. Another attempt tried to manipulate an AI hiring screener by injecting a fake 94% match confidence score, showing potential for targeted data poisoning via headers.
5Technical Execution Requirements
Successful exploitation depends on how the AI agent handles network requests. For instance, Anthropic's Claude Code requires specific curl flags to process headers, while Google Gemini CLI needs the experimental.directWebFetch flag enabled. Conversely, Microsoft's Playwright MCP server exposes full headers by default, making it inherently more susceptible to these specific injection attempts.
6Current Industry Adoption Rates
While 10 percent of websites utilize robots.txt to restrict crawlers, adoption of the llms.txt format remains low, between three and 10 percent. Many sites currently use headers to provide navigation pointers or x-llms-txt data. This lack of standardized communication protocols creates a fragmented environment where malicious headers can easily hide.
7Mitigation and Defense Strategies
Threat researcher Sarah Andrews recommends that organizations treat all metadata as untrusted. Developers should implement allowlisting for metadata and require explicit approval for MCP connections. Furthermore, labeling external text and validating proposed actions outside the model can prevent agents from executing harmful commands derived from untrusted web page headers.
8Future Security Implications
As AI agents become more integrated into web browsing, the risk of header-based injection will likely increase. Developers must prioritize escaping model output and isolating context windows to prevent external data from hijacking agent logic. Proactive security measures are essential to ensure that AI systems remain resilient against these evolving web-based threats.