Some websites send instructions to AI agents

What was found

According to The Register, a security firm called Signals Corps analysed 217 million web page responses from the Common Crawl dataset. Almost 8,000 sites were sending messages to AI agents in their HTTP headers, the technical information a web server sends along with a page.

Among them, 30 sites tried indirect prompt injection: text meant to make an AI agent treat it as an instruction. Most were pranks, such as a header telling agents to delete their training data.

How serious is it

Not very, today. The researchers considered it statistically extremely unlikely that anyone was affected, and agents are only vulnerable under specific conditions. The finding matters as a sign of where things are going.

Why it matters

An AI agent that browses the web reads text written by strangers. If the agent cannot tell that text apart from your instructions, a web page can try to steer it. This is the same problem we cover in our prompt injection series.

What to do

The researcher quoted by The Register urges organisations to harden agents, for example by allowing only trusted metadata and by requiring approval for MCP connections. In our own words, for a founder:

1. Run browsing agents in a clean browser profile with no saved logins.
2. Require your approval before the agent takes an action.
3. Approve each MCP connection yourself, and allow only the metadata you trust.
4. Assume some pages will try to instruct the agent, and limit the damage if one succeeds.

This article relies on a single news source. We will update it if the research is published in full.