Cases › security breach › LR-2026-0202
Indirect prompt injection attempts embedded in HTTP response headers across websites
Severity minor: The attempts were contained to a small number of sites and the likelihood of any user being affected remained extremely low.
Earliest source we hold 2026-10-16
Security firm Signals Corps sampled 217 million HTTP page responses from the Common Crawl archive and found 30 sites whose headers attempted indirect prompt injection, instructions hidden in content an AI agent reads on a user's behalf. Twenty-two of the 30 appeared to be pranks, and eight carried payloads that could have affected a visiting agent under the right conditions. The firm said the likelihood of any user being affected remains extremely low.
Risk grouping: AI attacked
| Who caused it | A person or organisation “Of those, 30 attempted indirect prompt injection, a technique where malicious instructions hide inside content an AI processes on a user's behalf.” source |
|---|---|
| Intended or not | Intended “Of those, 30 attempted indirect prompt injection, a technique where malicious instructions hide inside content an AI processes on a user's behalf.” source |
| Before or after release | After release “The statistical likelihood of any user being affected by these headers remains extremely low.” source |
| The AI's part | Attacked “Eight headers contained payloads that could have affected a visiting AI agent under the right conditions.” source |
The story
1 · What it was doingSignals Corps researchers analyzed 217 million HTTP responses from Common Crawl to find websites embedding AI-directed metadata and indirect prompt injection attempts in HTTP response headers that AI agents may read when crawling or summarizing pages.
2 · What went wrongThirty sites embedded indirect prompt injection attempts in headers, hiding malicious instructions in content an AI processes on a user's behalf; eight headers contained payloads that could have affected a visiting AI agent under the right conditions.
3 · What it reached or didThe attempts reached HTTP response headers read by AI agents under specific configurations, including Claude Code, Gemini CLI and Playwright MCP; the statistical likelihood of any user being affected remained extremely low.
4 · How it was caughtSecurity researchers at Signals Corps discovered the injection attempts by analyzing 217 million HTTP responses from the Common Crawl archive.
5 · What was doneSignals Corps' researcher Andrews recommended treating header-based metadata as untrusted input.
What the sources state
- Cause hostile input carried instructions
- What set it off hidden instructions in its input
Show every field, with its source and grade
The AI system
Tools it was given
browser network request, curl
C one secondary source states it
What happened
Earliest source we hold
2026-10-16
A the date the source itself carries
What set it off
hidden instructions in its input
C one secondary source states it
Who caught it
an independent researcher or journalist
C one secondary source states it
Near miss
yes, no harm happened
D inferred by us from the described behaviour, reason shown
Cause
hostile input carried instructions
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
Where its input came from
HTTP response headers
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
What it did
The injection attempts were embedded in HTTP response headers that AI agents may read when crawling or summarizing pages; 30 sites attempted indirect prompt injection, with eight headers containing payloads that could have affected a visiting AI agent under the right conditions.
D inferred by us from the described behaviour, reason shown
Impact
Severity
minor
D inferred by us from the described behaviour, reason shown
Who was affected
30 sites attempting indirect prompt injection via HTTP response headers; nearly 8,000 sites communicating with AI agents through custom headers
C one secondary source states it
Why this severity
The attempts were contained to a small number of sites and the likelihood of any user being affected remained extremely low.
D inferred by us from the described behaviour, reason shown
Context
Industry
Information
D inferred by us from the described behaviour, reason shown
Base count
217,000,000 units
C one secondary source states it
LR-2026-0202 · version 6 · published 2026-10-22 after automatic checks; not yet checked field by field by a person · changes to this case · JSON