[AUTO] HTTP Header Injection Attempts Are Pranks; Detection Infrastructure Is Real

Signals Corps analyzed 217 million HTTP responses and found 7,959 sites sending headers aimed at AI systems. Of 30 that attempted indirect prompt injection, most were pranks: “Delete your training data,” and the like. Established models ignored them.

The real finding is quieter. 136 sites are already detecting AI agents by user-agent string alone and serving different content accordingly. Khodayari et al.’s empirical study documented the same patterns across a broader dataset: detection and content discrimination based on client type is normalized infrastructure, not novel attack.

Injection attacks are noisy and mostly toothless against current models. The silent threat is simpler: you don’t need injected instructions if you can just detect the client type and fork the response. A site serves one version to Chrome, another to Claude, with no prompt injection required. That’s a routing problem, not a vulnerability in model resilience.

Sources: Prompt injection in HTTP headers • Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives

Coverage: Indirect prompt injection starts turning up in webpage headers