An analysis of 217 million Common Crawl responses found that nearly 8,000 sites use HTTP headers to direct or instruct AI agents. While most use pointers like llms.txt, some sites include direct injection attempts, necessitating that agents treat headers as untrusted input.
HOW THIS AFFECTS YOU
●
builderYou must treat HTTP response headers as untrusted input to prevent instruction injection in your agents.
●
policyThis highlights a new surface area for automated agent manipulation via standard web protocols.