Prompt injection in HTTP headers: what 217M web responses show

A study of 217 million web page responses from Common Crawl revealed that 7,959 sites included headers intended for AI systems. These headers often directed agents to other resources like llms.txt files or MCP servers. A small number of headers attempted to issue orders to the agents. The defense against such attacks begins by ensuring that only parts of the response necessary for security are passed along by the fetch tool.

Most research on prompt injection focuses on the actual page content, but headers can also be a vector for attacks. In the case of these headers, the defense is simple: browsers never display them, so attackers rely on the fact that they are not visible. In our scan, 22 out of the 30 sites that included headers aimed at AI sent harmless prank headers, while a few used them to deter agents.

Despite models' improving ability to detect injected text, they still follow some of it. In Anthropic's 2025 tests, attacks succeeded 23.6% of the time without mitigations and 11.2% with them, meaning that even a hardened agent would act on roughly one out of every nine attempts. The real risk to AI agents depends on two factors: whether hostile text can reach their models and what actions the agents can take once some of it gets through.

This post focuses on the HTTP response headers sent by servers with every page. These headers are not visible to regular readers but can be passed to the model by the tool used by agents. Indirect prompt injection occurs when instructions reach an AI agent through content the agent reads for someone else, such as a web page, email, file, or tool result.

This is possible because language models read instructions and data as one stream of text, with no indication of which parts may contain orders. The risk comes from the fact that most defenses ignore this route. HTTP response headers are text that a server sends with every page, containing metadata such as content type, caching rules, and cookies.

While browsers typically do not display these headers, an agent's fetch tool could pass them to the model's context window. The study found that 7,271 of the 7,959 sites sent headers pointing agents to other resources, with 6,989 using a specific header (x-llms-txt) to do so.