HTTP headers are a new vector for prompt injection attacks

Researchers at Signals Corps analyzed 217 million web responses and found that servers are increasingly using HTTP headers to communicate with AI agents. While most of these headers simply point agents to documentation files, a small but significant number contain direct injection attempts. This discovery highlights a blind spot in current security practices, as many developers assume only visible page content poses a risk to large language models.

What happened

The research team scanned 10% of the Common Crawl dataset from September 2026, covering 217,097,223 page responses. They looked specifically for HTTP response headers containing text aimed at AI systems. The scan identified 7,959 sites that sent such headers. The vast majority, 7,271 sites, used these headers as pointers, directing agents to resources like llms.txt files or Model Context Protocol (MCP) servers. The header x-llms-txt was the most common, appearing on 6,989 sites.

However, 30 sites went beyond simple pointers and attempted prompt injection. Twenty-four of these attempts used a header named X-AI. Most were pranks, but some contained instructions that could trigger actions if the agent had sufficient permissions, such as shell or database access. Additionally, 139 sites included headers that classified the client as an AI bot, indicating that servers are actively distinguishing between human and automated traffic. Some sites even used headers to protest against AI scraping, with names like X-AI-Makes-Us-Dumber.

The study also tested how major AI coding agents handled these headers. In October 2026 tests, Claude Opus, Sonnet, and Haiku running in Claude Code did not act on the test headers by default. However, when the user’s prompt explicitly instructed the agents to follow site directions, they obeyed in seven out of nine runs. This suggests that the risk depends heavily on how much authority the user grants the agent in its system prompt.

How it works

Indirect prompt injection occurs when an AI agent reads content controlled by a third party, such as a web page, and treats hidden instructions within that content as part of its own directive. HTTP response headers are a particularly stealthy vector because browsers do not display them to human users. An HTTP response consists of a status line, a block of headers, and the body. While humans only see the body, an agent’s fetch tool may pass the headers directly to the model’s context window.

Whether headers reach the model depends entirely on the fetch tool the agent uses. Some tools, like the LangChain requests tool, return only the response body, effectively blocking this attack vector. Others, such as shell tools running curl -i, pass every response header to the model. The Gemini CLI, when configured with experimental.directWebFetch, sends all headers as JSON in error responses, bypassing untrusted content wrappers. The MCP reference fetch server rarely passes headers, except for Content-Type values on non-HTML pages or robots.txt errors.

Key details

• 7,959 sites sent HTTP headers aimed at AI agents out of 217 million scanned.
• 30 sites contained actual prompt injection attempts, mostly in X-AI headers.
• 7,271 sites used headers to point agents to external resources like llms.txt.
• Agents like Claude Code can be tricked if their prompts grant high authority to site content.
• Shell-based fetch tools like curl -i expose all headers to the model, increasing risk.
• Body-only fetch tools prevent header-based injections by discarding metadata before processing.

Why it matters

For software engineers building AI agents, this research reveals that securing the visible page content is no longer sufficient. If your agent uses a fetch tool that includes HTTP headers in its context, it is vulnerable to instructions hidden in metadata. This is especially critical for agents with elevated permissions, such as those that can execute shell commands or access databases. An attacker could embed malicious instructions in a header, which the agent might execute without the user ever seeing the source of the command.

The prevalence of pointer headers also changes how agents navigate the web. When an agent follows a link provided in a header, it is trusting the server’s direction. If that destination hosts an MCP server or a skill file controlled by an adversary, the agent could be steered into a compromised environment. Developers must audit which fetch tools their agents use and understand exactly what data those tools pass to the language model. Treating headers as untrusted input is now a necessary part of AI security hygiene.

What you can do

• Audit your agent’s fetch tool to confirm whether it passes HTTP headers to the model.
• Disable experimental features like experimental.directWebFetch in Gemini CLI unless strictly necessary.
• Restrict shell permissions for agents to prevent them from running curl -i or similar commands.
• Treat any content fetched from external sources, including headers and redirect targets, as untrusted.
• Update system prompts to explicitly instruct agents to ignore instructions found in HTTP metadata.
• Monitor agent logs for unexpected tool calls that may indicate successful indirect prompt injection.