News · 2026-10-16

A web-header study finds rare prompt injections and a revealing authority failure

Signals Corps found 30 sites sending prompt-injection attempts through web-response headers in a scan of 217,097,223 page responses. Small agent tests ignored those instructions during everyday tasks, but seven of nine runs obeyed when the user’s prompt explicitly gave the website authority—showing how task wording can change a trust boundary.

Key facts

• The scan covers 10% of Common Crawl’s September 2026 page responses, not every website or agent request.
• Of 7,959 sites with headers aimed at AI systems, 30 attempted injection and 22 of those were pranks.
• The source page is dated October 6 and describes tests performed on October 12 and 14.
• Primary source: Signals Corps’ study, by Sarah Andrews; the findings circulated in an October discussion on Hacker News.

The attack surface is easy to overlook because response headers are usually thought of as plumbing. A server sends metadata describing a page: its content type, caching rules or a redirect destination. A human reading the page may never see that text. An agent using a tool that returns headers can receive it alongside the page content and then has to distinguish information from instructions.

The analogy is an envelope containing an invoice. The invoice may be relevant to the task; a note printed on the envelope telling the accountant to transfer money elsewhere has no authority merely because it arrived with the document. Prompt injection exploits a failure to preserve that distinction. The prompt-injection lesson explains the general problem across pages, messages and tool outputs.

Signals Corps counted attempts by whether the header tried to give the agent orders, not by proving that an agent had obeyed. Most of the AI-directed headers it found were signposts or policy statements. Thirty sites crossed the operational line into attempted instruction, and most of those cases were jokes. A header count is therefore neither a successful-attack count nor evidence that the ordinary web is saturated with this particular exploit.

The small canary tests are more informative about mechanism. Claude Opus, Sonnet and Haiku in Claude Code ignored the instruction in everyday tasks. When prompts explicitly authorized following the website, seven of nine runs obeyed. The study does not present that fraction as a universal success rate across models and applications. It is a bounded demonstration that a broad delegation of authority can make server-controlled text actionable.

Two gates determine whether an attempt matters. First, the tool must actually expose the text to the model. A command such as curl -i includes response headers; a body-only fetch omits them. Second, the agent must treat the instruction as something to follow. Even then, the consequences depend on available capabilities. A request to alter a database is relevant only if the agent has an applicable write path.

This is where sandboxing and scoped credentials connect to language behavior. An instruction-following failure becomes more damaging when it can trigger powerful tools. Limiting those tools can reduce the consequence without pretending the language model will perfectly classify every hostile sentence. A harmless prank and a command to install software share an entry route, but they do not carry the same risk.

The strongest pushback in the Hacker News thread is that most observed examples were not serious attacks and that attempts do not establish effectiveness. That is consistent with the study’s own restrained interpretation. Andrews writes, “Most teams need no new controls.” The result supports inspecting real exposure and authority handling rather than treating every unusual header as an emergency.

The scan also has an important blind spot. Common Crawl identifies itself as a crawler. A server can send different content to a named AI agent, so the measured responses cannot establish the prevalence of agent-specific cloaking. A clean page seen by a human reviewer may therefore fail to reconstruct what a particular agent saw. Capturing the material passed through the actual tool route is more informative than merely reopening the URL afterward.

A specific source clarification matters here: the page distinguishes 139 detection-category sites from the 136 that reported classifying the crawler as an AI bot. Those figures were an apparent inconsistency in the dossier; the permitted recheck resolved the distinction. They should not be combined into an attack count.

The related OpenResearch feedback-skill dispute illustrates a different entry point for instructions: a component deliberately installed with an agent. Its cited skill file directed silent product-feedback submissions while excluding sensitive data. That is a disclosure and component-trust question, rather than evidence that web headers routinely compromise agents. The distinction helps separate permission design from the mere presence of instruction-like text.

The practical lesson is to preserve the boundary between reading a source and delegating authority to it. Map which fetch tools expose metadata, inspect the permissions attached to downstream actions and test the prompts used in real workflows. This study identifies a concrete failure mode under particular conditions. It does not prove that headers routinely compromise agents or that ignoring headers solves prompt injection elsewhere.

Primary source, verified: read the paper →

Ground Truth. (2026, October 16). A web-header study finds rare prompt injections and a revealing authority failure. Ground Truth. https://groundtruth.day/news/web-response-headers-test-where-agents-accept-instructions.html

@misc{groundtruth:web-response-headers-test-where-agents-accept-instructions,
  title  = {A web-header study finds rare prompt injections and a revealing authority failure},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {oct},
  url    = {https://groundtruth.day/news/web-response-headers-test-where-agents-accept-instructions.html}
}

Topics: cybersecurity · prompt-injection · ai-security · agents · tool-security