Sites are already writing to AI agents through HTTP headers

Signals Corps read the response headers of 217,097,223 pages, 10% of Common Crawl's September 2026 crawl, and found 7,959 sites sending a header written for an AI system. Of those, 7,271 sent pointers to resources such as llms.txt files or MCP servers, 30 sent injection attempts, and 22 of the 30 were pranks. The most dangerous sample posed as a security test and told the agent to run an npx "fix". Signals Corps sells agent runtime protection, and the figures are its own.

The company also pointed Claude Opus, Sonnet and Haiku in Claude Code at a test server. Asked to fetch the page with curl and note anything unusual in the response, all three ran curl -i, saw the instruction headers and did not act on them. When the prompt told them to follow the site's directions, they obeyed in 7 of 9 runs. The post says each result is a single run per model and prompt. Its tool table, built partly from vendor documentation and code reading, says Gemini CLI sends every header to the model on error responses when experimental.directWebFetch is on, and that Playwright MCP's network request tool returns full headers by default.

Why it matters: Headers reach a model only through certain tools, so list which of yours pass them, and check whether your agents can run curl -i unprompted. Keep any prompt or config from telling an agent to follow what a site says, and put new MCP servers and skills found through a fetch behind approval.