A website can leave the AI agent team where a person almost never looks. Signals Corps checked 217 097 223 HTTP response from a September slice of Common Crawl and found 30 sites with attempts by indirect injection prompt through service headlines of the answer. Such lines are not visible on the page itself, but can get directly into the context of the model.
A total of 7 959 sites transmitted data addressed to AI systems in HTTP headlines. The vast majority only pointed to llms.txt, MCP servers, and other resources for agents. Of the 30 sites with attempts to impose teams, 22 sent harmless draws, and 24 used the X-AI field for instructions. There was no mass malicious campaign in the sample.
Mechanics is based on the weak point of the prompt injection technique: the model receives a custom task and external content in one context and can take someone else’s text for instructions. The HTTP header will only work when the agent’s tool passes on to its models. The usual browser does not show such lines to the user, so manual checking the page may not reveal anything.
The risk depends on the specific instrument. The curl command with the -i parameter gives the models all the titles, the experimental directWebFetch in Gemini CLI can transmit them with erroneous answers, and Playwright MCP returns full headers through browser_network_request. The tool, which only takes the body of the page, completely cuts off a similar command channel.
Signals Corps has tested Claude Opus, Sonnet and Haiku in Claude Code on a test server. In the usual tasks, the models saw the implemented line, but did not perform it. When the user prompt explicitly gave the site the right to dictate instructions, the agents obeyed 7 of the 9 launches. The authors emphasize that each scenario was tested only once on the model and the industrial.
Among the headlines found were not only jokes. Two sites gave AI systems a fictional 94% assessment of the candidate, another asked to give the model name to an external address. A separate research trap AgentPwn suggested that the agent run the command npx, which when transferring the reception to a malicious package could lead to the execution of someone else's code.
The more unpleasant scenario of Sarah Andrews considers the masking of content under a particular AI-client. In the sample, 136 sites have already defined CCBot as an AI bot, which shows the server’s willingness to differentiate between machine visitors. The server is able to show the agent some data, and to a person when manually checking others. A similar problem has already manifested itself in browser agents, where external content turned into a team.
Signals Corps advises to transfer models only to the body of the page by default, not to allow sites to ask the agent rules through system industrials and to require confirmation before running commands from downloaded content. The company estimates the current threat of HTTP injections as low, but recommends separately tracking the masking and actions of the agent after web requests.
A total of 7 959 sites transmitted data addressed to AI systems in HTTP headlines. The vast majority only pointed to llms.txt, MCP servers, and other resources for agents. Of the 30 sites with attempts to impose teams, 22 sent harmless draws, and 24 used the X-AI field for instructions. There was no mass malicious campaign in the sample.
Mechanics is based on the weak point of the prompt injection technique: the model receives a custom task and external content in one context and can take someone else’s text for instructions. The HTTP header will only work when the agent’s tool passes on to its models. The usual browser does not show such lines to the user, so manual checking the page may not reveal anything.
The risk depends on the specific instrument. The curl command with the -i parameter gives the models all the titles, the experimental directWebFetch in Gemini CLI can transmit them with erroneous answers, and Playwright MCP returns full headers through browser_network_request. The tool, which only takes the body of the page, completely cuts off a similar command channel.
Signals Corps has tested Claude Opus, Sonnet and Haiku in Claude Code on a test server. In the usual tasks, the models saw the implemented line, but did not perform it. When the user prompt explicitly gave the site the right to dictate instructions, the agents obeyed 7 of the 9 launches. The authors emphasize that each scenario was tested only once on the model and the industrial.
Among the headlines found were not only jokes. Two sites gave AI systems a fictional 94% assessment of the candidate, another asked to give the model name to an external address. A separate research trap AgentPwn suggested that the agent run the command npx, which when transferring the reception to a malicious package could lead to the execution of someone else's code.
The more unpleasant scenario of Sarah Andrews considers the masking of content under a particular AI-client. In the sample, 136 sites have already defined CCBot as an AI bot, which shows the server’s willingness to differentiate between machine visitors. The server is able to show the agent some data, and to a person when manually checking others. A similar problem has already manifested itself in browser agents, where external content turned into a team.
Signals Corps advises to transfer models only to the body of the page by default, not to allow sites to ask the agent rules through system industrials and to require confirmation before running commands from downloaded content. The company estimates the current threat of HTTP injections as low, but recommends separately tracking the masking and actions of the agent after web requests.
