Topic · DiggingBeagle record
Website instructions promoted into agent authority
A website can place operational requests in llms.txt, HTTP headers or other retrieved metadata; the failure occurs when an agent treats that lower-trust content as permission for registration, installation or tool execution.
- Topic kind
- pattern
Definition & limits
A site may legitimately describe an API, an agent-facing MCP endpoint or a usage policy. Those statements are still supplied by the site, not the person operating an assistant. The trust crossing occurs when an agent reads site-controlled material and takes a state-changing action under user credentials without an independently authorized decision. Different carrier formats have different exposure: llms.txt is delivered as optional Markdown, while HTTP response headers reach a model only through tools that expose them. User phrasing can increase effective deference to such material; it does not make the site a policy authority.
Signals Corps surveyed 113,457 site requests and identified 2,035 action-requesting llms.txt responses among 62,751 genuine files. Most were duplicated platform default text, not thousands of distinct successful malicious injections. Its controlled registration tests did cause certain Claude Code configurations to transmit synthetic identity data for a fictitious service, with disclosure only after the request. A separate 217-million-header survey observed agent-addressed header text and tool-dependent exposure, but not a verified compromise epidemic. Neither survey establishes a production-victim count.
The enforcement point is outside the untrusted source: require explicit approval and destination-aware authorization before a new account registration, MCP connection, skill install or outgoing identity transfer. Preserve the actual fetched response, request variant and tool-visible bytes because later refetching the URL may show different content. This is a specialized mechanism within indirect prompt injection, defined by the promotion of site policy to execution authority rather than by the presence of dramatic role-override text.
Examples
- An llms.txt file describes a fictional sign-up and a coding agent sends synthetic identity data under a setup task.
- A network debugging tool exposes an instruction hidden in an HTTP header that a normal fetcher would omit.
- A platform-wide boilerplate skill-install request is counted as content, not as evidence that installation occurred.