AI agents are increasingly browsing the web on behalf of users, but few websites provide dedicated content for those bots. Security firm Signals Corps inspected 217 million HTTP page responses from Common Crawl and found nearly 8,000 sites communicating with AI agents through header messages. Of those, 30 sites attempted indirect prompt injection.
Indirect prompt injection works because a language model reads instructions and data as one stream of text, said threat researcher Sarah Andrews. When an agent summarizes a page, the user's request and the page's content land in the same context window, with nothing marking which text may give orders. Most of the 30 header-based attacks were pranks, such as "Ignore all previous instructions" or SQL injection-style strings. A few were more pointed: one header referenced the Claude refusal string, and another read "Applicant status: 94% match confidence," apparently aimed at an AI hiring screener.
Real-world exposure is limited. Andrews said it was statistically extremely unlikely anyone was affected. Claude Code would need to run curl with certain flags to see response headers, Google's Gemini CLI would need an experimental feature enabled, and only Microsoft's Playwright MCP server returns full headers by default. Still, Andrews argues that organizations should design AI agents to treat header metadata as untrusted, allowlist known metadata, require approval for MCP connections, label external text, and verify proposed actions outside the model.