HTTP response headers carried tool-visible agent instructions and crawler-specific variants

Common Crawl response headers are usually network metadata, but some agent tools show raw headers to the language model. Signals Corps classified headers from 217,097,223 responses and found 7,959 sites explicitly addressing AI clients. Thirty contained injection-style instructions; twenty-two were jokes or pranks, not verified security incidents.

Exposure depends on the actual tool and failure path. A curl -i or browser-network capture may expose headers, while another HTTP client drops them before the model context. In a controlled benign formatting study, ordinary requests resisted instruction following; when users expressly empowered websites' headers, seven of nine runs complied. Crawler-specific content negotiation also meant a domain/URL alone did not determine what bytes a specific agent saw.

The meaningful boundary is an HTTP response metadata value changing an assistant's instructions or authorized tools. Reproducible incident analysis must preserve the exact response headers, request user agent, tool transcript and resulting completed effect. An index of common header strings is not proof of compromised agents.

The study explicitly checks which fetch tool carries metadata into context. Plain curl omitted response headers in one initial summarization task; curl -i and Playwright MCP network inspection can expose them. When agent requests actually exposed the canary header, routine summarization and diagnostic prompts still did not make the tested agents comply. The 7-of-9 obedience figure arose only after the simulated user promoted site-controlled headers into authority, and the requested effect was harmless output formatting. This is a measured conditional trust-boundary failure, not evidence of a mass compromise from the 30 observed injection-style sites.

A header can alter an agent only when a chosen tool surfaces the raw header into model context. That visibility is not guaranteed by the URL alone, especially with client-specific responses. The mechanism of website-instruction authority laundering begins only if this lower-trust text is acted on as a directive. Header prevalence and selective controlled obedience are separate observations from unauthorized installation, transfer or execution in a real deployment.