Full Report
Most attempts were pranks, but some could fool unwary AI agents
Analysis Summary
# Vulnerability: Indirect Prompt Injection via HTTP Headers
## CVE Details
- **CVE ID**: N/A (General architectural weakness in LLM integration)
- **CVSS Score**: N/A (Varies by implementation; potentially **Medium** to **High** depending on agent permissions)
- **CWE**: CWE-506 (Embedded Malicious Code), CWE-116 (Improper Encoding or Escaping of Output)
## Affected Systems
- **Products**: AI Agents, LLM-based web crawlers, and automated site-analysis tools.
- **Versions**: All current versions of AI agents capable of processing full HTTP response metadata.
- **Configurations**:
- AI agents configured to fetch web content where response headers are included in the context window.
- Specifically noted: Anthropic Claude Code (if running `curl` with header flags), Google Gemini CLI (with `experimental.directWebFetch` enabled), and Microsoft Playwright MCP server (default configuration).
## Vulnerability Description
This flaw involves **Indirect Prompt Injection** delivered through HTTP response headers rather than the page body. Because many LLMs process instructions and data as a single undifferentiated stream of text, an AI agent tasked with analyzing a URL may ingest malicious instructions hidden in metadata fields (e.g., `x-ai`, `x-llms-txt`). If the agent places these headers into its context window without sanitization, the LLM may interpret the header values as system-level commands rather than passive data.
## Exploitation
- **Status**: PoC available / Actively observed in the wild (Common Crawl research).
- **Complexity**: Low (Requires only the ability to set custom HTTP headers on a web server).
- **Attack Vector**: Network (Indirectly via a manipulated web resource).
## Impact
- **Confidentiality**: **Medium** (Potential for agents to exfiltrate session data or private context).
- **Integrity**: **High** (Potential to override agent behavior, provide false analysis, or trigger unauthorized actions like SQL injection strings in downstream tools).
- **Availability**: **Low** (Potential for Denial of Service via "refusal strings" that cause the LLM to stop responding).
## Remediation
### Patches
- There is no single patch as this is an architectural flaw in how LLMs handle context. Developers must update agent-specific logic to sanitize inputs.
### Workarounds
- **Allowlisting**: Only permit the AI agent to read specific, trusted metadata headers.
- **Header Stripping**: Middlewares or proxies should strip non-standard `x-*` headers before passing content to an LLM.
- **Delimiting**: Explicitly label external text (e.g., "The following is untrusted metadata from a third party") to prevent the model from treating it as a command.
## Detection
- **Indicators of Compromise**: HTTP responses containing headers like `x-ai`, `x-llms-txt`, or custom keys containing strings such as "Ignore all previous instructions," "Applicant status: 94% match," or SQL syntax (e.g., `DROP ALL TABLES`).
- **Detection Methods**: Security teams should audit web egress logs for AI agents to identify unusual header keys in incoming traffic.
## References
- **Signal Corps Research**: hxxps[://]www[.]signalscorps[.]com/blog/prompt-injection-in-http-headers/
- **LLMS.txt Standard**: hxxps[://]llmstxt[.]org/
- **Claude Refusal String Info**: hxxps[://]hackingthe[.]cloud/ai-llm/deprecated/claude_magic_string_denial_of_service/