← All incidents

Signals Corps scanned 217M web responses for HTTP headers aimed at AI agents: 7,959 sites, 30 injection attempts, 22 of them pranks

Research · AI agents and fetch tools that read HTTP response headers (curl in an agent shell, Gemini CLI direct fetch, Claude Code WebFetch, MCP fetch server, Playwright MCP) · LOW

Summary

Signals Corps, a company that sells AI-agent runtime protection, read the HTTP response headers of 217,097,223 page responses (10% of Common Crawl's September 2026 crawl) looking for text written for AI systems. 7,959 sites sent one. Almost all were signposts: 7,271 pointed agents to an llms.txt file, an MCP server or similar resource (6,989 of them via an x-llms-txt header). 30 sites sent an injection attempt, and 22 of those were pranks. The figures are Signals Corps' own. In its tests, Claude Code ignored a test instruction header unless the user's prompt told it to follow the site, and Signals Corps concludes most teams need no new controls. The useful part is knowing which of your tools pass headers to the model at all.

Severity

Timeline

1. Sep 2026
   Common Crawl September crawl (CC-MAIN-2026-39); Signals Corps samples 10% of its responses.
2. Oct 6, 2026
   Signals Corps publishes 'Prompt injection in HTTP headers: what 217 million web responses show'.
3. Oct 15, 2026
   The Register covers the research.

How it happened

A header only reaches a model if the agent's fetch tool passes it along. Signals Corps describes five routes. A shell tool running curl -i passes every response header. An error path such as the Gemini CLI direct-fetch mode, on a status of 400 or above, passes all headers as JSON without the untrusted wrapper; Signals Corps notes this applies to Gemini CLI's web_fetch when its off-by-default experimental.directWebFetch setting is on. A summarizing fetch tool such as Claude Code WebFetch passes a model-written extract and the redirect target. The MCP reference fetch server passes the Content-Type value on non-HTML pages and the robots.txt body in errors. A body-only tool drops every header. Separately, Signals Corps says Playwright MCP returns full headers when an agent calls its default browser_network_request tool. In its tests with Claude Opus, Sonnet and Haiku in Claude Code, every everyday run ignored the header; when the prompt gave the site authority, 7 of 9 runs obeyed. Because Common Crawl fetches as CCBot, headers shown only to named AI agents would not appear in these counts.

How to check your app

• List the fetch tools your agents use and what each passes to the model. Body-only should be the default; a shell tool running curl -i exposes every header.
• If you use Gemini CLI, check your settings for experimental.directWebFetch. It is off by default; with it on, Signals Corps says error responses (status 400 or above) pass all headers to the model as JSON without the untrusted wrapper.
• If you use Playwright MCP, remember its browser_network_request tool returns full headers.
• Search your prompts, system prompts and agent configs for wording that tells the agent to follow a site's instructions. In Signals Corps' tests that turned a refusal into compliance.
• Require approval before an agent runs a package or script a web response suggested (for example npx, or curl piped to sh).

Sources

• Signals Corps: Prompt injection in HTTP headers: what 217 million web responses show
• The Register: Indirect prompt injection starts turning up in webpage headers

Corrections and updates

None. Re-checked against every source on Oct 16, 2026.