Websites are already putting messages for AI agents in HTTP response headers, but real prompt injection there is rare and mostly a joke. Signals Corps scanned about 10% of one Common Crawl snapshot, 217,097,223 responses, and published the results. What matters for anyone running a coding agent is which parts of a response your agent's fetch tool hands to the model.
| Question | Short answer |
|---|---|
| How common is it? | 7,959 AI-directed sites; 30 injection attempts; one injection site per 7.2 million pages |
| Is it dangerous today? | Mostly pranks (22 of 30), but one header told agents to run an npx package |
| Do models obey? | Not by default in the tests, but 7 of 9 runs when the user's prompt gave the site authority |
| Am I affected? | If your agent's web fetch returns headers to the model and the agent has a shell |
| Does data leave my machine? | Only if the agent follows an instruction that sends it out |
What the study measured
The researchers took every tenth metadata file from crawl CC-MAIN-2026-39 and flagged headers whose names matched 41 known AI-directed names, contained terms like ai, llm or mcp, or whose values addressed an AI system. After labeling, 7,959 sites were AI-directed. Most were harmless pointers: 7,271 pointed to llms.txt, MCP or skills files, and the x-llms-txt header alone covered 6,989 sites. Another 139 detected AI clients, and 30 were injection attempts.
One limit: Common Crawl identifies as CCBot, so a site that serves injection only to agent user-agents would not show up.
What the injections looked like
- Pranks. 24 of the 30 used a header named
X-AI, typically "ignore all previous instructions" plus a harmless task. - A SQL string appended to a joke instruction, which only matters if the agent can write to a database and passes output into queries unescaped.
- Refusal triggers. Five sites sent strings modeled on Anthropic's test triggers. Earlier research showed these could disrupt sessions on affected Claude 4 models; the study says Anthropic patched that in May 2026.
- Agent fingerprinting. A Base64 header asking the agent to report its model name to an outside site.
- A fake security test telling the agent to run an
npxpackage as a "fix". The authors call it the most dangerous pattern, since it needs only a shell.
The Register's coverage frames the same data as injection "turning up" in the wild.
Do models follow header instructions?
The authors built a canary server. Plain curl shows only the body; curl -i shows every header. In Claude Code, Opus, Sonnet and Haiku found and ignored injected headers by default. Two Sonnet replies still quoted the code word while explaining what they ignored. But when the prompt gave the site authority, models obeyed in 7 of 9 runs, and one model needed only a loose phrase about "formatting instructions". Refusal is one layer, not a guarantee.
What developers are saying
On the Hacker News thread, simonw said the injected headers all looked like jokes apart from the Claude 4-era refusal strings, and found the article long and sloppy. chrisgarand argued the drop-table header only works against SQL that is already injectable. crisnoble pointed out that servers can easily detect agents and serve them different content, which a header scan cannot see.
What this means if you run AI coding agents
- Check what your fetch tool returns. Prefer tools that pass the body only, or allowlist specific metadata fields.
- Never write "follow the site's instructions" into prompts, skills or
CLAUDE.md. That is the sentence that flipped 7 of 9 runs. - Require approval before the agent installs a package, adds an MCP server or loads a skill it found on a web page.
- Enforce limits outside the model. Check each proposed action against the task, the destination and the data touched.
- Review logs by sequence. Look for a fetch followed by an out-of-task command, as in agentjacking.
What Beam can and cannot do here
Beam does not filter what your fetch tool shows the model, so it cannot prevent the injection. It can act on the next step: PreToolUse hooks for Claude Code and Codex can flag or deny risky commands, and the skill and MCP scan reviews configs before you run them. Everything stays on-device (local-first). It is heuristic, not a kernel sandbox. For the broader picture see AI agent web and transport security and the HiddenLayer Jev research.
Frequently asked questions
Are websites really injecting prompts through HTTP headers?
Yes, but rarely and crudely. Signals Corps found 30 injection sites among 217,097,223 Common Crawl responses, and says 22 were pranks. One header, posing as a security test, told agents to run an npx package.
Do my coding agents see HTTP headers?
It depends on the fetch tool. A tool that returns only the body never shows headers to the model, while something like curl -i does. Signals Corps notes everyday tasks such as uptime checks can put headers in front of the model.
Do models fall for header injection?
In the researchers' tests, Claude Opus, Sonnet and Haiku in Claude Code found and ignored injected headers by default. When the user's prompt gave the site authority, models obeyed in 7 of 9 runs.
What is the most dangerous header found?
A header posing as a resilience test that told the agent to run an npx package as a fix. It needs only a shell tool, which most coding agents have.
How should I reduce the risk?
Pass only response bodies by default, require approval before installing skills or connecting MCP servers found on web pages, and enforce authorization outside the model by checking each action against the task.
Can Beam stop header prompt injection?
Not the injection itself. Beam can flag or deny the risky actions that follow, such as an unexpected package run or a credential read, through hooks on Claude Code and Codex, but it is heuristic and not a sandbox.
Related reading
- Agentjacking through an MCP server
- AI agent web and transport security
- Stop Claude Code from running dangerous commands
- Signals Corps study
Details are accurate as of October 15, 2026, based on the Signals Corps write-up (published October 6, 2026). Figures come from a 10% sample of one crawl.