Key points
- Signals Corps identified 30 sites attempting indirect prompt injection via HTTP headers.
- Most attacks were pranks, but the technique can fool unwary AI agents.
- The source material does not mention any available fixes or patches.
Security firm Signals Corps discovered that 30 websites are using HTTP headers to attempt indirect prompt injection against AI agents. The firm sampled 217 million HTTP page responses from Common Crawl and found nearly 8,000 sites communicating with AI agents via header messages. Among those, 30 sites included instructions designed to manipulate the agents. According to The Register, most of these 30 attempts were pranks rather than serious exploits.
In plain English
Indirect prompt injection occurs when malicious instructions are embedded in content an AI agent reads on behalf of a user. Threat researcher Sarah Andrews explained that language models process instructions and data as a single stream of text. When an agent summarizes a page, the user's request and the page content land in the same context window. Nothing in the text distinguishes which part contains orders, allowing hidden instructions in headers to override legitimate commands.
The background
HTTP responses include protocol information, headers with key-value pairs, and optional body content. Signals Corps found that 7,271 sites transmitted pointers directing AI agents, and 6,989 sites sent the x-llms-txt header. Only about 10 percent of sites use robots.txt rules to restrict AI crawlers. Separate surveys indicate only three to 10 percent of sites provide agent-oriented content in the form of llms.txt. This proposed format exposes website information to AI systems, but it is not widely adopted.
What changes now
The discovery highlights a new attack surface for AI agents interacting with web content. While 22 of the identified attacks were pranks, such as headers telling agents to delete training data, the underlying vulnerability remains. The technique relies on the lack of separation between system instructions and external data in the context window. The source material does not state that a patch or configuration change has been released to address this specific header-based injection vector.
Who needs to act first
Teams should prioritize auditing systems that allow AI agents to browse untrusted web content. Check whether your agents parse HTTP headers or rely on metadata for navigation decisions. Implement strict input validation to separate user data from system instructions before processing. Test agent behavior against known prompt injection payloads in isolated environments. Back up agent configurations and logs to detect unexpected changes. Reduce exposure by restricting agents to whitelisted domains where possible.
Background: Input validation
Input validation cyber security requires checking every piece of data entering a system for type, length, and format. You must reject unexpected data immediately. This prevents attackers from injecting malicious code or causing system crashes. Trusting user input without strict rules allows breaches to occur.
Read the full guide: Input Validation Cyber Security: Stop Code Injection Before It Starts
What to do and how to stay safe: Signals Corps
- Review AI agent configurations to ensure they ignore or sanitize HTTP headers from untrusted sources.
- Implement context window separation techniques to distinguish between system prompts and external data.
- Monitor agent logs for unexpected commands or deviations from expected behavior patterns.
- Restrict agent access to sensitive systems until vendor updates address this injection vector.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many sites were found using indirect prompt injection?
Signals Corps found 30 sites attempting indirect prompt injection via HTTP headers in their sample.
Are these attacks currently being used for serious exploits?
Most of the identified attacks were pranks, but the technique could fool unwary AI agents.
Is there a fix available for this vulnerability?
The source material does not mention any available fixes or patches for this issue.
