Indirect Prompt Injection via HTTP Headers Targets AI Agents
Websites are using HTTP headers to manipulate AI crawlers through malicious prompt injection techniques.
1Emerging AI Security Threat
Security researchers identified a new attack vector where websites use HTTP headers to perform indirect prompt injection against AI agents. While most sites ignore bot-specific communication, a sample of 217 million responses from Common Crawl revealed nearly 8,000 sites actively sending messages to AI agents via custom metadata fields.
2Scope of Header Manipulation
Out of the sampled sites, 7,271 provided redirection pointers for AI crawlers, while 6,989 utilized the x-llms-txt header format. Among these, 30 instances were identified as deliberate attempts at indirect prompt injection. These attacks exploit the way language models process instructions and external data within the same context window.
3Nature of Malicious Payloads
Most identified attacks functioned as pranks, such as commands instructing AI agents to ignore previous instructions or delete training data. One header even attempted an SQL injection-style command, while others targeted specific model behaviors, including a reference to a Claude refusal string that remained active until May 2026.
4Targeting Automated Hiring Systems
Some headers displayed sophisticated attempts to influence specific AI workflows, such as an x-ai header claiming an applicant had a 94 percent match confidence. These efforts represent a shift toward manipulating AI-driven decision-making processes, though the statistical likelihood of these specific headers successfully impacting an active AI agent remains extremely low.
5Technical Execution Requirements
Successful exploitation depends on how the AI agent interacts with web traffic. For instance, Anthropic's Claude Code requires specific curl flags to process headers, and Google Gemini CLI needs the experimental.directWebFetch flag enabled. Conversely, Microsoft's Playwright MCP server automatically returns full headers, potentially increasing the attack surface for those specific implementations.
6The Context Window Vulnerability
The core vulnerability exists because language models treat instructions and retrieved data as a single, undifferentiated stream of text. When an agent summarizes a page, the model cannot distinguish between legitimate content and malicious commands hidden in headers. This lack of clear boundary marking allows injected instructions to influence model output.
7Mitigation Strategies for Developers
Threat researcher Sarah Andrews advises organizations to treat all metadata as untrusted input. Recommended defenses include allowlisting specific metadata fields, requiring explicit approval for MCP connections, and labeling external text to prevent it from being interpreted as commands. Developers should also validate proposed actions outside the model to ensure system integrity.
8Future Security Implications
As AI agents become more autonomous in browsing the web, the risk of header-based injection will likely evolve. Organizations must prioritize escaping model output and implementing strict input sanitization. Protecting the context window from external influence is essential to prevent unauthorized command execution as AI integration into web-based workflows continues to expand.