Security Report Finds Websites Using HTTP Headers to Target AI Agents
A security analysis has found that nearly 8,000 websites use HTTP response headers to communicate with AI agents, with 30 sites attempting indirect prompt injection attacks that could influence how automated systems interpret web content.
Signals Corps reached the findings after examining 217 million HTTP page responses collected by Common Crawl. The research identified 7,271 sites providing pointers directing AI agents elsewhere and 6,989 sites sending the x-llms-txt header.
Although AI agents are increasingly designed to interact with websites, relatively few sites provide dedicated, agent-friendly reading material. Surveys suggest that only around 3% to 10% of websites publish llms.txt files, a proposed format for making website information accessible to AI systems. About 10% use robots.txt rules to restrict AI crawlers.
The more concerning cases involve indirect prompt injection, in which instructions are embedded in material an AI agent reads on behalf of a user, such as a webpage, email, file or tool result.
Threat researcher Sarah Andrews explained that language models process instructions and data within the same stream of text. When an agent is asked to summarize a webpage, both the user's request and the page content enter its context, potentially making it difficult to distinguish trusted instructions from hostile text.
HTTP headers carry protocol information and standard or custom metadata alongside web content. Signals Corps found that many of the messages were jokes rather than credible attacks. Twenty-two cases included attempts to make AI systems ignore previous instructions, delete training data or execute text resembling an SQL injection command.
Other examples appeared more targeted. One header referenced a Claude refusal string that could cause the system to decline requests until May 2026. Another contained the message "Applicant status: 94% match confidence," suggesting an attempt to influence an AI-powered recruitment screening system.
The researchers said the likelihood of anyone being affected by the messages was extremely low. Whether an agent can be influenced depends on how its tools handle HTTP response headers.
For example, Claude Code would need to run curl with suitable flags to expose the headers, Andrews said. Google Gemini CLI would require the experimental.directWebFetch flag to be enabled. Microsoft's Playwright MCP server, by contrast, returns full headers by default through its browser_network_request tool.
Andrews recommended that organizations build safeguards against header-based attacks into their AI systems. Measures include allowlisting metadata, treating redirect destinations as untrusted, requiring approval for MCP connections, clearly separating external text from executable instructions, validating proposed actions outside the model and escaping model output for the context in which it is rendered.