Prompt Injection in HTTP Headers

A scan of web response headers for instructions aimed at AI agents. An instruction in a header can only reach a model if the agent’s fetch tool passes headers through, as curl -i, some error paths and some MCP fetch servers do; tools that fetch only the page body never see them.

In a 10% sample of Common Crawl’s September 2026 crawl, a few thousand sites sent headers meant for AI, mostly pointers to llms.txt files or MCP servers, or policy statements. Thirty tried an injection, and most of those were pranks. In the authors’ own test, Claude models ignored a header instruction under ordinary prompts but mostly followed it when told the user owned the site and to follow its headers.

The finding they flag as worth watching is cloaking: servers already label AI clients, so a site can show people one page and agents another. Their advice: fetch the body only by default, keep claims of site authority out of prompts, require approval before running anything a fetched page suggests, and log fetches.