7,959 sites are already slipping instructions to AI agents through HTTP headers
Prompt injection in HTTP headers: what 217M web responses show
A scan of 217 million web responses from Common Crawl found 7,959 sites sending headers aimed at AI agents. Most point to resources like llms.txt, but 30 carry injection attempts. Whether those headers reach a model depends on the fetch tool: curl passes everything, while others filter. Tests with Claude models showed they found the headers but obeyed only when prompted to follow site directions.
When the user’s prompt told them to follow the site’s directions, they obeyed in 7 of 9 runs, so the refusal depends on how much authority your prompts give a site.
- simonw
This article is way too long, and very sloppy.
Here's the section with the prompt injection headers. They all look like jokes / non-serious attempts to me, bar the ones that included the Claude 4 era refusal triggering string. https://www.signalscorps.com/blog/prompt-injection-in-http-h...
- crisnoble
This article goes through great lengths to basically say your agent should probably not obey headers saying random things. However, it is apparently it is very easy for servers to detect agents, therefore would be trivial to serve them different content in the res.text() than to a human user. This doesn't even need to be adversarial, it makes sense to send back a stripped down version to agents for both the server and the agent ingesting the data, but becomes a problem for anyone who wants to show different content to the agents.
- tcdent
Traditionally, computing and especially the web has used structured formats to designate placement of how information is interpreted, and even the level of trust which is given to it. But as we see with things like HTTP headers in this article, when an LLM interprets content, it's all just text.