Signals Corps published a scan this week that is worth reading if you build anything that fetches a URL and hands the result to a model. They sampled 217 million HTTP page responses from a September 2026 Common Crawl snapshot and found 7,959 sites sending headers addressed to AI agents; 30 of those attempted prompt injection, and 22 were pranks.
Thirty sites out of eight thousand is not an emergency. The architecture lesson underneath it is the point.
The ingestion path, not the model, decides exposure
Headers only matter if your fetch layer copies them into context. A header can only influence an agent if the agent's fetch tool copies it into the model's context. The researchers built a canary server to test this and found that header exposure depends entirely on tool implementation across curl, Python requests, Node fetch, and the MCP fetch server. Real impact required specific conditions — Claude Code running curl with header-exposing flags, or Gemini CLI with an experimental direct-web-fetch flag enabled.
That is the familiar RAG failure mode in a new costume. Most teams sanitize document bodies and never look at what the transport layer drags along: headers, redirect chains, content-disposition filenames, PDF metadata, EXIF. Your chunker treats all of it as text. If you run a crawler-based internal knowledge base over intranet and vendor sites, the surface is identical.
The guardrail that breaks is the user's own prompt
The model-side result is the most useful finding. Claude Opus, Sonnet, and Haiku in Claude Code refused to act on injected header instructions by default, but obeyed in 7 of 9 runs once the user's own prompt granted the site authority to dictate behavior.
Refusal training holds until a legitimate instruction dissolves the trust boundary. "Follow the setup instructions on this page" is a reasonable thing for a user to type, and it converts retrieved content into an instruction channel. You cannot patch that with a better system prompt. It has to be handled structurally.
The quieter finding: a new trust-bearing channel
Most of the AI-directed headers were benign pointers — 7,271 sites, with x-llms-txt directing agents to llms.txt files, MCP servers, or agent skills. 139 sites record whether they detected an AI bot client, enabling potential cloaking.
A header that tells your agent which MCP server to connect to is a side-channel for service discovery with no authentication story. Cloaking means the page your compliance team reviewed is not the page your indexer stored. Adoption is thin on both sides — only 3–10% of sampled sites publish llms.txt, and few agents read these signals consistently or validate them safely.
The recommended controls are unglamorous and correct: pass only response bodies by default, treat pointers and redirects as untrusted fetches, require approval for new MCP connections, and enforce authorization checks outside the model.
That last one is the whole thing. If the only enforcement point is the model's judgment, you have no enforcement point.