HTTP response headers can carry prompt injections against AI agents, researcher shows
arpit_bhayani · x · 2026-10-16
Arpit Bhayani demonstrates a neglected prompt injection channel: HTTP response headers. Since models read instructions and data as one text stream, a header like X-AI: Ignore all previous instructions becomes part of the context when a tool copies headers in. Agents running curl -i see every header, and servers can serve malicious headers only to known AI user agents—so manual review of the URL may show nothing. Opus and Sonnet ignore such headers by default, but many models comply. Worst case: injection tricks a shell-equipped agent into running npx on an attacker-chosen package. Fixes: pass only the body to the model, treat redirects as untrusted fetches, and never let agents blindly follow website instructions.
More from coding & agent
- A vector DB is not LLM memory: long thread maps write/read paths, failure modes and evals — techNmak · 2026-10-16
- 10 GitHub repos to see what your AI agent really did, from Langfuse to claude-code-log — victor_explore · 2026-10-16
- Mosaic: multi-session agentic RL with hierarchical advantage estimation — LARK-Lab · 2026-10-16
- Recursive Environment Scaling tanks six models' success rates by 57–77 points — Lingxiao Jing · 2026-10-16
- Harvard's MPT: decentralized agent swarms learn self-orchestration via bidding — Harvard · 2026-10-16
- How LiteLLM routes one OpenAI-shaped API across every model provider — Mahmoud_Zalt · 2026-10-16