← Friday, October 16, 2026AgentsDeep dive

A scan of 217 million web responses found few prompt-injection headers

signalscorps.com 12 min read Editor score 8/10

The scan found 30 injection attempts among 7,959 sites with AI-targeted headers; in tests, models obeyed 7 of 9 times only when the user prompt gave the site authority. The more actionable risk is sites identifying AI clients and potentially serving them different content.

What: AI-targeted HTTP headers are rare: 30 of 7,959 sites sending AI-directed headers tried to give an agent orders.
How: Fetch tools differ: some pass headers into model context, while body-only tools drop them; tested Claude Code models obeyed only when users gave sites authority.
Why it matters: Engineers should check what their agent’s fetch tools expose and whether sites can identify AI clients by user-agent.

Several fetch routes carry response headers to model context; a body-only route drops them. Sketched from the article's own text.

Read on signalscorps.com → Hacker News · 17 comments

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.