Signals Corps finds indirect prompt injection attacks in web headers
A security firm discovered that dozens of websites are embedding malicious instructions in HTTP headers to manipulate AI agents.
Key points
- Signals Corps identified 30 sites using HTTP headers for indirect prompt injection.
- Most attempts were pranks, but researchers warn they could fool unwary AI systems.
- Only a small fraction of websites currently provide dedicated content for AI crawlers.
Security firm Signals Corps reported finding indirect prompt injection attempts hidden within the HTTP headers of dozens of websites. The company analyzed a sample of 217 million page responses from Common Crawl and identified nearly 8,000 sites communicating with AI agents via metadata. Among those, 30 sites contained instructions designed to manipulate the behavior of visiting artificial intelligence systems.
The findings highlight a growing vector for attacking AI agents that process web content. While the majority of the 30 detected incidents were harmless pranks, researchers noted that the technique could potentially deceive less sophisticated agents. One example header under the x-ai key instructed an agent to ignore previous commands and delete its training data.
How indirect prompt injection works
Threat researcher Sarah Andrews explained that indirect prompt injection occurs when instructions reach an AI agent inside content it reads for another user. This includes web pages, emails, files, or tool results. The vulnerability exists because language models process user instructions and external data as a single stream of text within the same context window.
Andrews stated that nothing in the text inherently marks which parts are authoritative orders versus passive data. When an agent summarizes a page, the user’s request and the page content land together. This lack of separation allows embedded commands in headers to override the agent’s original task if the model fails to distinguish between the two.
Adoption of AI-specific web standards
The discovery comes as few websites supply dedicated reading material for automated bots. According to The Register, only about 10 percent of sites use robots.txt rules to restrict AI crawlers. Separate surveys indicate that merely three to 10 percent of sites provide agent-oriented content using llms.txt, a proposed format for exposing website information to AI systems.
Most of the 8,000 sites found communicating with agents used standard pointers. Signals Corps reported that 7,271 sites transmitted directions telling agents where to navigate next. Additionally, 6,989 sites sent the x-llms-txt header. These legitimate uses of metadata contrast sharply with the 30 sites that attempted to hijack agent behavior through malicious header values.
What should you do?
Organizations deploying AI agents to scrape or summarize web content should review how their systems handle HTTP headers. Developers need to ensure that metadata is treated as untrusted input rather than executable instruction. Monitoring for unusual header keys, such as x-ai or custom fields, can help identify potential injection attempts before they impact operations.
Background: Prompt injection attacks
Look for sudden shifts in tone, refusal to follow system constraints, or output that repeats hidden instructions. These signs indicate the model is processing injected commands rather than your intended query.
Read the full guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
What to do and how to stay safe: Signals Corps
- Audit AI agent configurations to ensure HTTP headers are parsed as data, not instructions.
- Implement strict context separation between user prompts and external web content.
- Monitor logs for unexpected agent behaviors or deviations from standard summarization tasks.
- Review website headers for custom keys that may signal malicious intent or pranks.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is indirect prompt injection?
It is an attack where instructions reach an AI agent inside content it reads for someone else, such as a web page or email.
How many sites were found with prompt injection attempts?
Signals Corps identified 30 sites that attempted indirect prompt injection via HTTP headers.
Are these attacks currently causing major damage?
Most of the 30 detected attacks were pranks, but researchers warn they could fool unwary AI agents.
