Indirect Prompt Injection Starts Turning Up in Webpage Headers
"Arthur T Knackerbracket" writes:
Despite the hype around AI agents interacting with websites, few sites bother to supply dedicated reading material for visiting bots. And occasionally, the message directed at visiting bots is an attempt at prompt injection.
While about 10 percent of sites use robots.txt rules to restrict AI crawlers, only about threeto10 percent of sites in separate surveys provide agent-oriented content in the form of llms.txt, a proposed format for exposing website information to AI systems.
But a handful of sites have taken to giving AI agents the finger via HTTP headers, the metadata sent with web page content.
When security biz Signals Corps sampled 217 million HTTP page responses from Common Crawl, it found almost 8,000 sites communicating with AI agents via header messages.
Much of this messaging - 7,271 sites - transmitted pointers telling the AI agents where to go next, and 6,989 of the sites sent the x-llms-txt header. And 30 of the sites attempted indirect prompt injection.
"Indirect prompt injection is an attack in which instructions reach an AI agent inside content it reads for someone else: a web page, an email, a file, or a tool result," said threat researcher Sarah Andrews in a blog post.
"It works because a language model reads its instructions and its data as one stream of text. When you ask an agent to summarize a page, your request and the page land in the same context window, and nothing in the text marks which part may give orders."
HTTP requests/responsesinclude protocol information (a method for requests or a status code for responses), headers consisting of key-value pairs of standard and custom fields, and, optionally, a body containing data or content.
Read more of this story at SoylentNews.