AI
HTTP response headers are becoming an overlooked prompt-injection route for AI agents
A scan of 217 million Common Crawl page responses found 7,959 sites sending headers aimed at AI systems, mostly pointers to resources such as llms.txt files or MCP servers. Thirty sites sent apparent injection attempts, while tests showed that agents generally ignored malicious headers by default when they reached the model. Compliance rose sharply when prompts granted websites authority. The findings make fetch-tool design and external authorization controls central defenses, while the researchers caution that results vary across models, tools and versions.
Editorial summary · Publisher article
What matters
- 7,271 of the AI-directed sites sent pointers, including 6,989 using x-llms-txt.
- Thirty sites sent injection attempts; 24 used an X-AI header and most were pranks.
- Seven of nine authority-granting test runs produced the requested code word.
- The authors recommend passing body content by default and treating pointers and redirects as untrusted fetches.
Why headers matter
Response headers are normally invisible to people but may be copied into an agent’s context by fetch tools. The danger depends on both whether the text reaches the model and what actions the agent can take afterward.
What the scan found
Most AI-directed headers were pointers rather than direct attacks, but the scan also found agent detection, possible content cloaking and headers making claims about content that a model could repeat as fact.
Context & caveats
- The scan covers one Common Crawl sample, and the live tests used specific models, prompts and harness versions. The publisher’s own control-plane product is mentioned in the source.
Why this made the edition
Detailed original measurement, methodology, live-agent tests and concrete defensive recommendations establish a consequential security story.
Source material