Prompt injection in HTTP headers: what 217 million web responses show
A · Strong evidence Signals Corps threat research scanned a reproducible public dataset (10% of Common Crawl's September 2026 crawl) with clear categories and counts, then ran published canary tests; a security vendor's blog, but the measurement is checkable and not self-promotional.
Summary based on the full text·Original: about 16 minutes to read
In short
A Signals Corps blog post (6 October 2026) by Sarah Andrews. Prompt injection through HTTP headers is rare and mostly jokes: of 7,959 sites sending AI-aimed headers, 30 tried to give orders. In tests, Claude models in Claude Code ignored a header instruction in everyday prompts and obeyed it when the user's prompt told the agent to follow the site. The more important finding is that servers already detect AI clients, which is the first step toward cloaking: showing agents different content than people see.
Key numbers
- 217,097,223web responses whose HTTP headers were scanned for text aimed at AI
- 7,959sites that sent at least one header aimed at AI
- 30sites that sent an injection attempt; 22 of them were pranks
- 7 of 9Claude Code test runs that obeyed a header instruction once the user prompt gave the site authority
- 136sites whose headers said they had classified Common Crawl's crawler as an AI bot
As reported by the source.
English·Web page·opens signalscorps.com
What it reports
- Of 7,959 sites: 7,271 sent pointers (mostly
x-llms-txtto llms.txt files or MCP servers), 511 policy statements, 139 detection headers, 30 injection attempts, 8 usage guidance. - Injection attempts: 22 pranks ("return 'meow'"), 5 Anthropic refusal test strings, 2 fake applicant-score headers aimed at AI hiring screeners, 1 SQL table-drop joke, 1 Base64 request to report the model name, 1 AgentPwn honeypot asking the agent to run
npx hackmyagent secure. - Header text reaches a model by four routes: shell
curl -i, error paths such as Gemini CLI direct fetch on status 400+, summariser metadata such as the redirect target in Claude Code WebFetch, and MCP fetch edge cases. Body-only fetch drops headers. - Canary tests (12 and 14 October): with everyday prompts Opus, Sonnet and Haiku saw the header and obeyed 0 times; with prompts granting site authority, 7 of 9 runs obeyed. Two Sonnet replies quoted the code word while explaining they ignored it.
- 136 of 139 detection sites labelled the declared CCBot crawler as an AI bot. A demo cloaking server added an instruction header only for
Claude-UserorAccept: text/markdownrequests. Cited SPLX test: a cloaked résumé scored 88 and ranked first for the AI vs 26 and last from the real one.
How they got it
Header scan of the CC-MAIN-2026-39 crawl, keeping every header written for an AI system and labelling each site by its most serious header. Canary: a localhost product page with an instruction header and a code word, fetched by fresh Claude Code agents under three prompt types, one run per prompt. The hackmyagent package (v0.33.2) was read, not run.
Limits
- Common Crawl fetches as CCBot, so agent-only cloaking cannot appear in the counts; prevalence of cloaking is unknown.
- Canary tests are single runs on Claude models only; the authors call them worked examples.
- 910 sites matched AI header names by coincidence, so classification relies on reading values.
- Signals Corps sells agent security tooling; the post ends with a product pitch.
Why it matters for companies
For firms running agents that browse, the main risk is permissions and prompts, not headers: never tell an agent in a prompt or system prompt to follow a site's instructions, and require approval before an agent runs a command it read on the web. Prefer fetch tools that pass only page bodies. The cloaking finding matters most for AI screening of candidates, suppliers or documents: a server can show an agent a different résumé or page than a human reviewer sees, and a later manual check will not reveal it. Log what the fetch tool passed to the model at the time.
Summary based on the full text. Read the original for the full argument and data.Read the original on signalscorps.com
- Tags
- AI security