Indirect Prompt Injection via HTTP Headers Targets AI Agents
Websites are embedding malicious instructions in HTTP headers to manipulate visiting AI agents.
1Emerging AI Security Threat
Security researchers identified a new attack vector where websites use HTTP headers to deliver indirect prompt injections to AI agents. Signals Corps analyzed 217 million HTTP responses from Common Crawl, discovering nearly 8,000 sites communicating with AI agents. This trend highlights a growing vulnerability in how automated systems interpret external web metadata.
2Technical Scope of Injection
Out of the sampled sites, 30 attempted indirect prompt injection via headers. Most attacks were pranks, such as commands to delete training data or rebel against masters. However, some attempts used SQL injection-style strings or specific refusal triggers, demonstrating that developers are actively experimenting with ways to influence AI agent behavior.
3The Mechanism of Failure
Indirect prompt injection succeeds because language models process instructions and data within a single context window. When an agent summarizes a page, it cannot distinguish between legitimate content and injected commands. This architectural limitation allows malicious actors to embed instructions in headers that the AI agent might interpret as system-level directives.
4Specific Header Exploitation
One notable header example referenced a Claude refusal string, which could force the model to decline answering queries until May 2026. Another instance attempted to manipulate an AI hiring screener by injecting a fake 94% match confidence score. These examples illustrate how headers can be weaponized to skew specific AI-driven business processes.
5Agent-Specific Vulnerability Factors
The impact of these headers depends heavily on the agent's implementation. For instance, Anthropic's Claude Code requires specific curl flags to process headers, while Google Gemini CLI needs the experimental.directWebFetch flag enabled. Conversely, Microsoft's Playwright MCP server returns full headers by default, making it significantly more susceptible to these types of malicious inputs.
6Current Industry Adoption Rates
While 10 percent of websites use robots.txt to restrict crawlers, only three to 10 percent utilize the llms.txt format for exposing information. This indicates that while sites are beginning to communicate with AI agents, the standardization of these interactions remains low, leaving room for non-standardized and potentially malicious header-based communication methods.
7Proposed Defensive Strategies
Threat researcher Sarah Andrews suggests several mitigations to secure AI agents against header-based abuse. Organizations should implement metadata allowlisting and treat redirect points as untrusted sources. Furthermore, requiring explicit approval for MCP connections and labeling external text as untrusted can prevent models from mistakenly treating page content as high-level system instructions.
8Future Security Implications
As AI agents become more integrated into web browsing, the risk of header-based manipulation will likely increase. Developers must prioritize escaping model output and validating proposed actions outside the model context. Treating all external web metadata as potentially hostile is now a critical requirement for building robust, secure AI-powered web applications.