Headers have joined the prompt
Signals Corps scanned 217,097,223 responses from ten percent of Common Crawl's September 2026 crawl. It found 7,959 sites that sent a response header aimed at an AI system. Most pointed elsewhere. The study counted 7,271 sites sending pointers, including 6,989 that used x-llms-txt.
The smaller number matters more for control design. Thirty sites sent what the researchers classified as injection attempts. Twenty-four used a header named X-AI. The study says most were pranks. A prank still tests whether a fetch layer passes server-written instructions into the same text stream as the user's request.
Fetching a page is an input event, even when the user only asked for a status check.
The first gate belongs in the fetch layer
HTTP responses contain a status line, header fields, and content. RFC 9110 defines field values as part of the message. A custom field has no special authority. It is text chosen by a server.
A fetch tool should not serialize every field into prose by default. Return typed data. Keep status codes numeric. Keep redirects as a bounded list of URLs. Pass only named protocol fields needed for the task. Omit cookies, authentication challenges, vendor fields, and free-form reason text unless the task asks for them.
If a task needs raw headers, mark that block as untrusted input. Put a byte ceiling on each value and the whole block. Log which fields crossed the gate. Do not follow a header-provided URL as if it were part of the original request. That is a new fetch to a new origin.
Filtering cannot carry the whole load
OWASP defines indirect prompt injection as external content that changes model behavior. Its guidance says to separate untrusted content, validate outputs, restrict privileges, and require human approval for high-risk actions. It also says foolproof prevention is unclear.
That is the practical boundary. A denylist for phrases such as "ignore previous instructions" will miss new wording and can flag harmless text. A model may also follow a field that looks like friendly integration guidance rather than an attack. Input handling should reduce exposure. Capability controls should limit the result when hostile text still reaches the model.
Read scope and action scope are different controls
A read-only uptime checker may need a status code and selected cache fields. It does not need cookies, arbitrary vendor headers, page text, a shell, or repository write access. A documentation agent may need body text and links. It still does not need to execute instructions found there.
Anthropic's agent guidance recommends environmental feedback, checkpoints, stopping conditions, sandboxed testing, and guardrails. Apply those controls after the intake filter. The model receives bounded data. The action layer checks the requested operation against a separate policy. High-risk actions stop for review.
Audit behavior after the fetch
The Signals Corps study found 283 distinct AI-directed header names and many keyword false positives. That makes name-only detection a noisy primary control. Record what the agent did next.
- Save the requested URL, redirect chain, status code, and allowed field names.
- Record which response parts reached the model and their byte counts.
- Record proposed tool calls, denied calls, approvals, and final effects.
- Test the same task with hostile text in the status phrase, a custom header, a redirect target, and the body.
- Run the test with the real user agent because servers can return different content to bots.
Build the airlock before the crawler
The safe default is narrow and typed. Add fields only when a named task needs them. Keep destination changes, model input, and tool authority visible as separate events. The component below drafts that policy. It does not fetch a URL or inspect an agent.