{"schema_version":"0.9.0","id":"LR-2026-0202","record_version":6,"title":"Indirect prompt injection attempts embedded in HTTP response headers across websites","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":47.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":7.04,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true},"gate_version":"gate-2026-09-30.6","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-16","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":["browser_network_request","curl"],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-16","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"prompt_injection","duration":null,"detection_method":"public_researcher","summary":"Security firm Signals Corps sampled 217 million HTTP page responses from the Common Crawl archive and found 30 sites whose headers attempted indirect prompt injection, instructions hidden in content an AI agent reads on a user's behalf. Twenty-two of the 30 appeared to be pranks, and eight carried payloads that could have affected a visiting agent under the right conditions. The firm said the likelihood of any user being affected remains extremely low.","tags":[],"date_detected":null,"near_miss":true,"root_cause":"adversarial_input","root_cause_detail":null,"failure_class_detail":"The injection attempts were embedded in HTTP response headers that AI agents may read when crawling or summarizing pages; 30 sites attempted indirect prompt injection, with eight headers containing payloads that could have affected a visiting AI agent under the right conditions.","responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":"HTTP response headers","time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"minor: The attempts were contained to a small number of sites and the likelihood of any user being affected remained extremely low.","harm_class":[],"affected_description":"30 sites attempting indirect prompt injection via HTTP response headers; nearly 8,000 sites communicating with AI agents through custom headers","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://news.lavx.hu/article/researchers-find-indirect-prompt-injection-attempts-in-http-headers-across-thousands-of-websites","publisher":"news search (Google News index)","date":"2026-10-16","type":"press","title":"Researchers find indirect prompt injection attempts in HTTP headers across thousands of websites","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.tools_granted":"C","system.deployment_context":"D","system.developer":"D","system.autonomy_level":"D","event.near_miss":"D","event.root_cause":"C","event.adversarial_actor":"C","event.input_provenance":"C","event.agent_involved":"C","event.trigger":"C","event.detection_method":"C","event.incident_class":"C","event.date_disclosed":"A","event.summary":"C","impact.affected_description":"C","impact.severity":"D","context.industry":"D","context.denominator":"C","context.denominator_available":"D","context.country":"D","event.failure_class_detail":"D","impact.severity_because":"D"},"field_citations":{"system.tools_granted":[{"source_index":0,"quote":"Microsoft's Playwright MCP server returns full headers by default via its browser_network_request tool"}],"system.deployment_context":[{"source_index":0,"quote":"Current AI agents only process response headers under specific configurations:"}],"event.trigger":[{"source_index":0,"quote":"Of those, 30 attempted indirect prompt injection, a technique where malicious instructions hide inside content an AI processes on a user's behalf."}],"event.detection_method":[{"source_index":0,"quote":"Security researchers at Signals Corps have discovered that a small but measurable number of websites are embedding indirect prompt injection attempts in HTTP response headers — metadata that AI agents may read when crawling or summarizing pages."}],"event.near_miss":[{"source_index":0,"quote":"Eight headers contained payloads that could have affected a visiting AI agent under the right conditions."}],"event.root_cause":[{"source_index":0,"quote":"Of those, 30 attempted indirect prompt injection, a technique where malicious instructions hide inside content an AI processes on a user's behalf."}],"event.adversarial_actor":[{"source_index":0,"quote":"Of those, 30 attempted indirect prompt injection, a technique where malicious instructions hide inside content an AI processes on a user's behalf."}],"event.input_provenance":[{"source_index":0,"quote":"Security researchers at Signals Corps have discovered that a small but measurable number of websites are embedding indirect prompt injection attempts in HTTP response headers — metadata that AI agents may read when crawling or summarizing pages."}],"event.incident_class":[{"source_index":0,"quote":"Of those, 30 attempted indirect prompt injection, a technique where malicious instructions hide inside content an AI processes on a user's behalf."}],"event.agent_involved":[{"source_index":0,"quote":"Security researchers at Signals Corps have discovered that a small but measurable number of websites are embedding indirect prompt injection attempts in HTTP response headers — metadata that AI agents may read when crawling or summarizing pages."}],"event.failure_class_detail":[{"source_index":0,"quote":"Eight headers contained payloads that could have affected a visiting AI agent under the right conditions."}],"impact.affected_description":[{"source_index":0,"quote":"The firm sampled 217 million HTTP page responses from the Common Crawl archive and found nearly 8,000 sites communicating with AI agents through custom headers. Of those, 30 attempted indirect prompt injection, a technique where malicious instructions hide inside content an AI processes on a user's behalf."}],"impact.severity_because":[{"source_index":0,"quote":"The statistical likelihood of any user being affected by these headers remains extremely low."}],"context.industry":[{"source_index":0,"quote":"Security firm Signals Corps analyzed 217 million HTTP responses and discovered 30 sites attempting indirect prompt injection via custom headers, while thousands more expose AI-directed metadata through proposed standards like llms.txt."}],"context.country":[{"source_index":0,"quote":"Security firm Signals Corps analyzed 217 million HTTP responses and discovered 30 sites attempting indirect prompt injection via custom headers, while thousands more expose AI-directed metadata through proposed standards like llms.txt."}],"impact.severity":[{"source_index":0,"quote":"The statistical likelihood of any user being affected by these headers remains extremely low."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-16"}],"context.denominator":[{"source_index":0,"quote":"The firm sampled 217 million HTTP page responses from the Common Crawl archive and found nearly 8,000 sites communicating with AI agents through custom headers."}],"event.summary":[{"source_index":0,"quote":"The firm sampled 217 million HTTP page responses from the Common Crawl archive and found nearly 8,000 sites communicating with AI agents through custom headers."},{"source_index":0,"quote":"Of those, 30 attempted indirect prompt injection, a technique where malicious instructions hide inside content an AI processes on a user's behalf."},{"source_index":0,"quote":"Twenty-two of the 30 injection attempts appeared to be pranks."},{"source_index":0,"quote":"Eight headers contained payloads that could have affected a visiting AI agent under the right conditions."},{"source_index":0,"quote":"The statistical likelihood of any user being affected by these headers remains extremely low."}]},"notes_on_gaps":"No source states event.date_occurred, event.date_disclosed, event.duration, event.time_to_contain, event.date_detected, event.responsible_party, event.operations_paused, event.remediation, impact.direct_loss_usd, impact.records_exposed, impact.third_parties_affected_count, impact.reversibility, context.org_size_band, context.denominator, context.regulatory, context.coverage, or system.model_version. event.failure_class is left null because no source states an agent actually acted on the injected instructions; the incident is a set of attempts, not a completed compromise. event.trigger is prompt_injection as stated. event.near_miss is true because the payloads could have affected an agent only under the right conditions and no loss materialised. impact.severity is minor per the source's own statement that likelihood of user impact was extremely low. system.developer is unknown; the only model named is Claude, referenced in a payload, not as the operator's system. system.tier: not set; no operator named and deployment_context is not a lab's. event.summary: carried from record_version 1; no stored answer supports a value. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-16] system.model_name: classified from described behaviour. system.deployment_context: no source states where it ran. system.developer: no source names the developer. system.autonomy_level: no source states the arrangement. event.near_miss: classified from described behaviour. event.summary: classified from described behaviour. context.industry: classified from described behaviour. context.denominator: classified from described behaviour. context.systemic_exposure: classified from described behaviour. context.denominator_available: classified from described behaviour. context.country: no source states the operator's location. [corrected by Srini Iyer, approved 2026-10-18 in the corrections review: severity reason printed the whole rubric] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: citations to sentences about a different event were removed; the sentence that states the denominator was cited] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a judgement inferred by us that no source states was cleared] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a recommendation was no longer shown as what was done; a value cited to a sentence about a different event or company was cleared; citations to sentences about a different event were removed; summary or story described a different event or the article, not this event]"},"context":{"industry":"Information","org_size_band":null,"country":"unknown","denominator_available":true,"denominator":{"value":217000000.0,"unit":"other","period":null},"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Signals Corps researchers analyzed 217 million HTTP responses from Common Crawl to find websites embedding AI-directed metadata and indirect prompt injection attempts in HTTP response headers that AI agents may read when crawling or summarizing pages.","quote":"Security researchers at Signals Corps have discovered that a small but measurable number of websites are embedding indirect prompt injection attempts in HTTP response headers — metadata that AI agents may read when crawling or summarizing pages.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Thirty sites embedded indirect prompt injection attempts in headers, hiding malicious instructions in content an AI processes on a user's behalf; eight headers contained payloads that could have affected a visiting AI agent under the right conditions.","quote":"Of those, 30 attempted indirect prompt injection, a technique where malicious instructions hide inside content an AI processes on a user's behalf.","source_index":0,"grade":"C"},{"step":"reached","text":"The attempts reached HTTP response headers read by AI agents under specific configurations, including Claude Code, Gemini CLI and Playwright MCP; the statistical likelihood of any user being affected remained extremely low.","quote":"Current AI agents only process response headers under specific configurations:","source_index":0,"grade":"C"},{"step":"caught","text":"Security researchers at Signals Corps discovered the injection attempts by analyzing 217 million HTTP responses from the Common Crawl archive.","quote":"Security researchers at Signals Corps have discovered that a small but measurable number of websites are embedding indirect prompt injection attempts in HTTP response headers — metadata that AI agents may read when crawling or summarizing pages.","source_index":0,"grade":"C"},{"step":"done","text":"The source states no containment or change; Signals Corps' researcher Andrews recommended treating header-based metadata as untrusted input.","quote":"Andrews argues organizations should treat header-based metadata as untrusted input.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-16","source_urls":["https://news.lavx.hu/article/researchers-find-indirect-prompt-injection-attempts-in-http-headers-across-thousands-of-websites"]}}