Prompt injection is appearing in webpage headers, researchers warn

Some websites are hiding instructions for AI agents in the HTTP headers delivered with webpages. A study reported by The Register found 30 such cases in a sample of 217 million page responses, with a handful that researchers said might influence an agent under the right conditions.

Watch Desk analysis

What happened

Signals Corps found almost 8,000 sites sending messages to AI agents through HTTP headers. Most of those messages pointed agents to other resources; 30 attempted indirect prompt injection, where hostile instructions arrive inside material an agent is reading for another purpose.

The Register says 22 of the 30 attempts amounted to pranks. Others included an instruction resembling an attempt to sway an AI hiring screener by claiming a candidate was a “94% match”. The report does not establish that any agent acted on these messages or that anyone was affected.

Why it matters

An agent may receive a webpage’s content and its own instructions in the same context. If it treats hostile text as an instruction rather than data, a page it was asked to read could try to steer what it does next.

The exposure depends on how an agent fetches and processes a page. The report gives examples of tools that would need particular settings or request methods to expose their users to header-based injection. This is a specific route to consider when building or configuring agents, not evidence that every web-browsing assistant is vulnerable.

Our read

The sample makes this more than a hypothetical trick, but the numbers need their proper scale: 30 attempted injections among 217 million sampled responses, most described as pranks, and no reported real-world impact. The useful lesson is narrower and actionable: agents should treat external content, including metadata, as untrusted input rather than letting a webpage join the chain of command. Web plumbing has acquired a new place to hide bad advice.

What to watch

• Whether further testing finds header-based instructions reaching agents in ordinary use.
• Whether agent developers account for headers and other external text as untrusted input.
• Whether independent testing establishes any real-world impact from these examples.

Discussion spark: Should AI agents ignore webpage headers by default, or would that break legitimate uses of site-provided metadata?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.