HTTP header prompt injection hides attacks in response metadata. With AI agents 2026 browsing the web autonomously, headers are a new attack surface. Audit your exposure free.
AI agents 2026 increasingly browse the web for you — and every HTTP response carries headers the agent may read. Attackers controlling a server can hide instructions in custom headers, turning a routine fetch into prompt injection. The agent never sees a suspicious page; the attack rides in metadata. This free audit checks whether your setup sanitizes headers and flags the most abused response fields.
HTTP header prompt injection hides malicious instructions in HTTP response headers that AI agents read while browsing. The agent follows the hidden instructions because it treats server metadata as trustworthy context.
Researchers at Signals Corps examined ~217 million HTTP page responses and found nearly 8,000 websites using response headers to communicate with AI agents — pointers, crawler rules, machine-readable summaries. And 30 of those sites were caught attempting indirect prompt injection: instructions smuggled into header content that an AI agent might read and obey. Meanwhile only 3–10% of sites publish an llms.txt at all. Your site's headers are talking to agents right now — do you know what they're saying? Run the free audit below.
Why headers matter: when you ask an agent to "summarize this page," your request and the page's content enter the model's context as one text stream. Anything in that stream — visible text, hidden markup, or response headers — can steer it. That's indirect prompt injection, and headers are its newest hiding place.
git clone https://gitlab.com/Iceman2050
cd header-hunter
python3 headerhunter.py https://your-site.com
Open source (MIT) by Ingenious AI. For managed chatbot red-teaming against the full injection playbook: ChatBreaker.
Attribution: the 217-million-response scan was conducted by Signals Corps researchers; Ingenious AI did not run it. Numbers above are as reported. MITRE ATT&CK v20 (Oct 2026) now tracks indirect prompt injection as technique T1698.
Researchers at Signals Corps examined roughly 217 million HTTP page responses collected via Common Crawl. They found nearly 8,000 websites using HTTP response headers to communicate with AI agents — including 7,271 sites with pointers directing agents elsewhere and 6,989 sending an x-llms-txt header. Among them, 30 sites were classified as attempting indirect prompt injection: embedding instructions in header content that an AI agent might read and obey.
An agent-directed header is an HTTP response header intended for AI agents rather than browsers — for example x-llms-txt pointing an agent to a machine-readable summary of the site, or headers naming which AI crawlers may access content. They are metadata about how automated readers should treat the page. Most are benign housekeeping; the study found a minority carrying instruction-like content.
Indirect prompt injection happens when hostile instructions are hidden in content an AI agent reads on behalf of a user — a webpage, email, file, or, as this study shows, HTTP headers. Language models process instructions and data in the same text stream, so an agent asked to summarize a page can be steered by instructions smuggled into that page's headers. The study documented 22 cases attempting to make AI systems ignore prior instructions, delete training data, or execute SQL-injection-like text.
llms.txt is a proposed convention for giving AI agents a clean, machine-readable summary of a website. With only 3–10% of sites publishing one, agents mostly ingest raw page content — headers included — which is exactly the unfiltered stream where injection attempts hide. Publishing an llms.txt gives you a say in what the agent reads first.
Run: curl -sI https://your-site.com and read every response header. Look for x-llms-txt or custom x-agent-* headers, check what they point to, and read the values for imperative language ('ignore', 'delete', 'execute', 'system prompt'). The free open-source tool header-hunter (gitlab.com/Iceman2050) automates this: it classifies headers as agent-directed, suspicious, or benign.
Your site isn't attacking anyone, but your visitors' AI agents still read your pages — including any third-party content, ads, or user comments embedded in them. The risk runs both ways: audit what your headers say to agents, and assume agents visiting your site ingest everything on the page. If you run a chatbot or agent that browses the web, treat fetched page content — headers included — as untrusted input.
Prompt injection is an attack that tricks an AI system into following instructions from an untrusted source. It works because LLMs process everything — your request, tool outputs, web pages, files — as one text stream, so the model can mistake attacker-planted text for orders it should obey.
Direct prompt injection is typed straight at the model by the user — the classic “ignore previous instructions”. Indirect prompt injection hides the instructions in content the model reads on your behalf — a web page, email, document, or file — so the attack arrives through the data channel instead of the chat box.
No. Sanitization and blocklists buy time, but attackers constantly rephrase, encode, or multi-turn their way around filters — OpenAI has acknowledged the underlying problem may never be fully solved. The accepted strategy is defense in depth: least-privilege agents, human approval for irreversible actions, and monitoring.