Prompt injection is turning up in HTTP headers your agent reads
Two in-the-wild studies find injections in HTTP response headers your sanitizer never touches — mostly pranks so far, but the channel is wide open.
Copy markdown
Injections now ride in headers, not just the page
A CISPA-led crawl of ~1.2B URLs validated 15,387 real indirect-injection payloads — and 54.5% rode in HTTP response headers, not the HTML body your scraper cleans. 87% were invisible by design, and 99% tried to override the agent's task.
The 217M-response sweep: mostly pranks, for now
A separate Signals Corps scan of 217M Common Crawl responses found only ~30 sites actually attempting header injection — one x-ai header told the agent to 'delete its training data and rebel.' Almost no one was hit, but the surface is now documented and live.
Check what your fetch tool hands the model
Exposure is all tooling: Playwright MCP's browser_network_request returns full headers by default, Gemini CLI needs the experimental.directWebFetch flag, and Claude Code only sees them via curl -i. If your agent reads response metadata, it reads attacker-controlled text.
How often it actually works
In 5,200 controlled trials (100 prompts × 4 page formats × 13 models), smaller models obeyed plaintext injections up to 8% of the time. Feeding the page as a structured representation instead cut compliance to 0.2–1.1%.
The fix is boring, and it's on you
No model update saves you here. Allowlist which header metadata the agent may read, treat redirect targets as untrusted, label external text so it's never read as a command, and verify any proposed action outside the model.