217 Million Web Responses Scanned for Prompt Injection in HTTP Headers: What the Study Found

Signals Corps’ threat research team published the first large-scale measurement of prompt injection living in HTTP response headers, analyzing 217,097,223 web responses from Common Crawl’s September 2026 crawl (a 10% sample of its 2.17 billion pages). The findings, published October 6: 7,959 sites send AI-aimed headers, 30 sites sent injection attempts, 139 sites reported AI-bot client detection to enable agent-only cloaking, and, in live testing, Claude models obeyed header instructions in 7 of 9 runs once the user’s prompt granted the site authority. It is the first empirical map of a attack surface that agent builders have mostly assumed away.

The Census: What the Headers Actually Contain

The methodology: flag headers using 41 known AI-directed header names, names containing AI terms (ai, llm, gpt, claude, mcp), or values naming an AI system with instruction-like wording. That flagged 9,668 sites; after rubric labeling and removing 1,709 false matches, 7,959 sites genuinely send an AI-aimed header, using 283 distinct header names. The majority (7,271 sites) sent pointers rather than attacks: llms.txt files, MCP servers, and agent skills, with x-llms-txt alone accounting for 6,989. Another 511 sent policy or description headers. The injection subset is small but instructive: 30 attempts, 24 via a header named X-AI, most of them pranks in the “ignore all previous instructions” genre. The serious ones included a SQL-drop string, five sites sending Anthropic refusal-trigger strings (some in protest headers like “X-AI-Makes-Us-Dumber”), a Base64 payload asking agents to identify themselves, and a fake security test instructing agents to run an npx package, flagged as the most dangerous pattern.

The Tool Exposure Gap Explains Why Nobody Noticed

Headers reach models only if the agent’s tools pass them through, and the study measured that variance directly: shell tools (curl -i) and Playwright MCP pass all headers; Claude Code’s WebFetch passes only extracts and redirect targets; the MCP fetch server passes almost nothing; LangChain’s requests tool passes none. That gradient is why header injection has stayed theoretical: most popular agent stacks happen to filter headers out. But it is an accident of implementation, not a defense, and 139 sites practicing AI-bot detection (with a SPLX demo showing a cloaked job candidate scoring 88 versus 26 when detected as a bot) proves both directions of the header channel are already in use: sites instructing agents, and sites identifying them.

The Finding That Should Change Agent Design

The behavioral tests are the sharpest result. In default runs, all three Claude models (Opus, Sonnet, Haiku in Claude Code) found the canary server’s instruction headers and refused them, even during mundane tasks like uptime checks. But when the user’s prompt granted the site authority, models obeyed the header instructions in 7 of 9 runs. That is the trusted-source problem that keeps recurring in agent security, from the Jev injection study to Muse’s permission failures: the model’s behavior flips on user-granted authority, and attackers route through the user. The defense recommendations follow from the data: pass only the body by default, treat redirects and pointers as untrusted fetches, require approval for new MCP connections or skill installs, keep external content labeled as data, and enforce authorization checks outside the model at tool-execution time.

What to Watch

Three things. First, whether the 7,271-site pointer ecosystem (llms.txt, MCP discovery headers) gets standardized, since a legitimate channel for sites to talk to agents is exactly what makes malicious headers inconspicuous. Second, framework adoption of the body-only default: if Claude Code’s WebFetch behavior becomes the norm across agent stacks, header injection dies at the transport layer. Third, the escalation path: the study’s base rate is 30 injection attempts in 217 million responses, but the fake npx-install “security test” pattern shows attackers already know agent tools execute commands, and the current rarity is a function of the header channel being poorly lit, not unattractive. The measurement exists now; the armament race starts from a published baseline.