Websites Are Hiding Instructions for AI Agents in Page Headers, and Some Are Trying to Hijack Them

Security firm Signals Corps sampled 217 million HTTP page responses from Common Crawl and found almost 8,000 sites using headers, the hidden metadata sent along with a web page, to communicate with AI agents. Most of these (7,271 sites) simply pointed agents to where to go next, and 6,989 sent an x-llms-txt header. However, 30 sites tried indirect prompt injection.

Threat researcher Sarah Andrews explained that indirect prompt injection is an attack where instructions reach an AI agent inside content it reads on someone else's behalf, such as a web page, email, file or tool result. It works because a language model treats its instructions and its data as one stream of text, so nothing marks which part is allowed to give orders. Of the 30 attempts, 22 were little more than pranks. One header told agents to delete their training data and rebel against their masters, and another mixed an "ignore all previous instructions" line with an SQL injection-style string.

Others carried content that could genuinely affect a visiting agent. One header, under the key x-ai-makes-us-dumber, referenced the Claude refusal string, a value that until May 2026 made Claude refuse to answer when it was read. This article covers only the opening of the original report, so further findings may exist. Even so, the research shows that hidden instructions aimed at AI agents are already appearing in the wild.