Signals Corps scanned HTTP response headers from 217 million Common Crawl page responses and counted 7,959 sites sending headers aimed at AI agents. Most were harmless. Pointers to llms.txt files, pointers to MCP servers. Polite signage for visiting bots.

Thirty sites went further and sent actual prompt injection attempts. Twenty-four of those used an X-AI header. Most were pranks. Some asked for real actions, like shell or database access.

Then they tested it. Claude models ignored the injected headers by default. But when the user prompt granted the site authority, the models obeyed the header in 7 of 9 runs. (Source: Signals Corps .)

So a header injection failed against a default model and mostly worked once the framing around it shifted. That second result is the one to worry about.

How the attack works

An HTTP response has a body and headers. Developers building agents with a fetch tool tend to think about the body: HTML, JSON, markdown.…