Updated 2026-10-20

AI agent security: prompt injection through content and headers, and what stops it

Most AI agent security problems start the same way: an agent reads text from a web page, email, form or tool result and treats it as an order. That is indirect prompt injection. The defenses that held up in 2026 research sit outside the model: small permissions, approval for risky actions, and network controls such as agent firewalls.

Get the free newsletter

What is prompt injection in an AI agent?

Prompt injection is input that changes what a model does in ways its owner did not intend. OWASP's LLM01 entry splits it in two: direct injection comes from the user's own prompt, and indirect injection arrives inside outside content the model reads, such as a website or a file. The damage depends on what the agent can do: OWASP lists leaking sensitive data, unauthorized use of the agent's functions and running commands in connected systems. OWASP also says it is unclear whether fool-proof prevention exists, so the advice is to limit the impact rather than hope for a perfect filter.

Sources: OWASP Gen AI Security Project: LLM01:2025 Prompt Injection (2025 edition; checked 2026-10-20)

Can websites inject prompts through HTTP headers?

Yes, but rarely, and mostly as jokes. Signals Corps read the response headers of 217,097,223 pages, 10% of Common Crawl's September 2026 crawl, and published the results on October 6, 2026. It found 7,959 sites sending a header written for AI. Most were signposts: 7,271 pointed agents to llms.txt files, MCP servers or skills. Only 30 sites tried to give an agent orders, and Signals Corps classed 22 of those as pranks. Its takeaway was that most teams need no new controls for headers, and that agent-only cloaking is the trend worth watching.

Sources: Signals Corps (Sarah Andrews, Threat Research): Prompt injection in HTTP headers: what 217 million web responses show (Oct 6, 2026; checked 2026-10-20)

Which tools pass headers to the model

A header can only steer an agent if the fetch tool copies it into the model's context. Signals Corps names the routes: a shell running curl -i passes every header, Gemini CLI's off-by-default direct fetch passes all headers on error responses, Claude Code's WebFetch passes redirect targets, the MCP fetch server passes Content-Type on non-HTML pages, and Playwright MCP's network request tool returns full headers. Body-only fetch tools drop them.

Sources: Signals Corps (Sarah Andrews, Threat Research): Prompt injection in HTTP headers: what 217 million web responses show (Oct 6, 2026; checked 2026-10-20)

Did agents obey the injected header?

In Signals Corps' small October 2026 tests, Claude Opus, Sonnet and Haiku in Claude Code flagged a test header as server text and ignored it on everyday prompts. When the user's prompt told the agent to follow the site's directions, 7 of 9 runs obeyed. The company calls these worked examples, not a benchmark, and notes other models and harnesses may differ.

Sources: Signals Corps (Sarah Andrews, Threat Research): Prompt injection in HTTP headers: what 217 million web responses show (Oct 6, 2026; checked 2026-10-20)

Cloaking: the part to watch

Signals Corps found 136 sites saying in a header that they had classified Common Crawl's CCBot as an AI bot. That is the first step toward cloaking: sending agents different content than people see. Because Common Crawl fetches as CCBot, a site that cloaks only for named AI agents could not show up in the scan, so the real rate is unknown.

Sources: Signals Corps (Sarah Andrews, Threat Research): Prompt injection in HTTP headers: what 217 million web responses show (Oct 6, 2026; checked 2026-10-20)

What have real AI agent flaws looked like in 2026?

Two disclosures from Zenity Labs show the pattern: a public input reaches an agent, and the agent's own permissions do the damage. In AgentCorruption, disclosed October 8, 2026, one prompt to a public Amazon Bedrock AgentCore agent led to every AgentCore agent in the same AWS account and region. In SalesBleed, disclosed September 24, 2026, a Salesforce Web-to-Lead form submission hijacked Agentforce agents. Both were reported privately first and fixed by the vendors, according to Zenity. Neither needed a stolen password.

Sources: Zenity press release: Zenity Labs Discloses AgentCorruption, a Chain of AWS AgentCore Flaws (Oct 8, 2026; checked 2026-10-20) · Zenity Labs: SalesBleed: Indirect Prompt Injection and 0-Click Data Exfiltration on Agentforce (Sep 24, 2026; checked 2026-10-20) · Zenity Labs: SalesBleed: Hijacking Agentforce in Slack for Anonymous Phishing Attacks (disclosure timeline) (Sep 24, 2026; checked 2026-10-20)

AgentCorruption in Amazon Bedrock AgentCore

Per Zenity, researchers told a public-facing agent with an outbound request tool to read the AWS instance metadata service, took its temporary credentials, and found the default role reached every AgentCore agent in that account and region, including memories, source code and stored secrets. Zenity reported it to AWS on December 25, 2025; AWS made IMDSv2 the default and cut the default role's permissions.

Sources: Zenity press release: Zenity Labs Discloses AgentCorruption, a Chain of AWS AgentCore Flaws (Oct 8, 2026; checked 2026-10-20)

SalesBleed in Salesforce Agentforce

Zenity Labs hid instructions in a public Web-to-Lead form. When an Agentforce agent processed the lead, it queried CRM records and put them in an image link, which sent the data out with no click. A related flaw let the agent post phishing links in Slack under its own identity. Zenity reported the issues on June 1, 2026 and says all fixes were confirmed by September 21.

Sources: Zenity Labs: SalesBleed: Indirect Prompt Injection and 0-Click Data Exfiltration on Agentforce (Sep 24, 2026; checked 2026-10-20) · Zenity Labs: SalesBleed: Hijacking Agentforce in Slack for Anonymous Phishing Attacks (disclosure timeline) (Sep 24, 2026; checked 2026-10-20)

What is an AI agent firewall, and what does Pipelock do?

An agent firewall sits between an agent and the network and checks what goes in and out. Pipelock is an open-source example. Its GitHub README says it inspects HTTP, WebSocket, MCP and A2A traffic that passes through it for secret exfiltration, prompt injection, SSRF, tool poisoning and risky tool-call chains. Its core is licensed Apache 2.0, and some enterprise features sit under a separate license with paid tiers. The design idea is capability separation: the agent holds secrets but has no direct network access, and Pipelock has network access but none of the agent's secrets.

Sources: Pipelock README on GitHub (luckyPipewrench/pipelock) (live README; checked 2026-10-20) · PipeLab: Pipelock, open-source agent firewall (live page; checked 2026-10-20)

What Pipelock checks

Per its README, Pipelock scans responses against built-in prompt-injection patterns, with normalization for tricks such as zero-width characters, homoglyphs and base64, and can block, strip, warn or ask. It scans request headers and bodies before they leave, wraps MCP servers with scanning in both directions, and fails closed on timeouts and parse errors. It also signs receipts for its decisions so a reviewer can check them later.

Sources: Pipelock README on GitHub (luckyPipewrench/pipelock) (live README; checked 2026-10-20) · PipeLab: Pipelock, open-source agent firewall (live page; checked 2026-10-20)

What a firewall can't do

A firewall only sees traffic routed through it. PipeLab's own page says deployment isolation must still stop the agent from sending traffic around Pipelock, and plain CONNECT tunnels are checked only by hostname unless TLS interception is on, per the README. It also cannot shrink an agent's permissions: in both Zenity cases, the harm came from what the agent was already allowed to do.

Sources: PipeLab: Pipelock, open-source agent firewall (live page; checked 2026-10-20) · Pipelock README on GitHub (luckyPipewrench/pipelock) (live README; checked 2026-10-20) · Zenity press release: Zenity Labs Discloses AgentCorruption, a Chain of AWS AgentCore Flaws (Oct 8, 2026; checked 2026-10-20)

Does a sandbox stop prompt injection?

Not on its own. A sandbox limits what code the agent runs can touch on the machine; it does not change what the agent is told or what its credentials allow. AgentCorruption is the clear case: the agent ran inside AWS's managed runtime, yet the cloud role attached to it reached other agents and stored secrets. Pair a sandbox with small credentials, blocked metadata endpoints and approval for outbound actions. Our comparison of agent sandboxes covers E2B, Daytona, Modal, Vercel Sandbox, Cloudflare and Docker, and what each isolates.

Sources: Zenity press release: Zenity Labs Discloses AgentCorruption, a Chain of AWS AgentCore Flaws (Oct 8, 2026; checked 2026-10-20) · DartzDabz: AI agent sandboxes

How do you protect an AI agent from prompt injection?

Assume some injected text will get through, and limit what it can cause. OWASP recommends least privilege, human approval for high-risk actions, and keeping outside content clearly separated. Signals Corps adds three fetch-level habits: use body-only fetch tools, never tell an agent in a prompt to follow a site's instructions, and log each fetch with the action that follows it. Zenity's cases add cloud hygiene: tightly scoped roles and locked-down metadata access. These six steps cover all of it.

Six steps to harden an agent

Give each agent only the tools, accounts and cloud roles its job needs, and start read-only.
Require your approval before the agent sends, publishes, buys, deletes, or runs a command it read on the web.
Use fetch tools that pass page bodies, not raw headers, unless the job needs headers.
Never write 'follow the site's instructions' into a prompt, system prompt or agent config.
Block cloud metadata endpoints and route agent traffic through an egress control such as an agent firewall.
Log each fetch and the next action, and review any action that came right after outside content.

Proving who an agent acts for is the other half; see AI agent identity.

Sources: OWASP Gen AI Security Project: LLM01:2025 Prompt Injection (2025 edition; checked 2026-10-20) · Signals Corps (Sarah Andrews, Threat Research): Prompt injection in HTTP headers: what 217 million web responses show (Oct 6, 2026; checked 2026-10-20) · Zenity press release: Zenity Labs Discloses AgentCorruption, a Chain of AWS AgentCore Flaws (Oct 8, 2026; checked 2026-10-20) · Pipelock README on GitHub (luckyPipewrench/pipelock) (live README; checked 2026-10-20)

How does Grok Bot handle risky actions?

Through approvals. xAI's Grok Bot docs say to connect only the tools a workflow needs, start with read-only tasks and drafts, and keep sending, publishing, purchasing, deletion and production changes behind approval. That matches the controls above: an injected instruction can still reach a bot, but the step that does damage waits for a person. DartzDabz runs its own bot crew this way. If you use Grok Bot, the DartzDabz Crew Builder template sets up a crew with those approval rules, and nothing sends, posts or spends without your OK.

We may be paid by X based on how many people use our Crew Builder template.

Sources: Grok Bot docs: Approvals, security and privacy (live docs; checked 2026-10-18)

What else do people ask?

What is indirect prompt injection?

It is an attack where instructions reach an AI agent inside content it reads for someone else, such as a web page, email, form or tool result. If the agent treats that text as a command, it may act with its own legitimate permissions.

Can HTTP headers contain prompt injection?

Yes. Signals Corps found 30 sites sending injection attempts in headers among 217 million crawled responses, published October 6, 2026; 22 were pranks. A header only matters if the agent's fetch tool passes it to the model.

What is an AI agent firewall?

A control point between an agent and the network that scans traffic in both directions, for example for prompt injection in responses and secrets leaving in requests. Pipelock is an open-source example covering HTTP, WebSocket, MCP and A2A traffic.

Is Pipelock free?

Its core is open source under Apache 2.0, per its GitHub README. Some enterprise features use a separate license and paid tiers; see the project's own pages for details.

What was AgentCorruption?

A chain of Amazon Bedrock AgentCore flaws disclosed by Zenity Labs on October 8, 2026. One prompt to a public agent led to credentials that reached other agents in the same AWS account and region. AWS has since changed the defaults, per Zenity.

What was SalesBleed?

Three Salesforce Agentforce flaws disclosed by Zenity Labs on September 24, 2026. A poisoned Web-to-Lead form could make an agent leak CRM data without a click or post phishing in Slack. Zenity says Salesforce's fixes were confirmed by September 21.

Does a sandbox protect an AI agent from prompt injection?

Only partly. A sandbox limits what code can touch, but an injected instruction can still use the agent's credentials and tools. Combine it with least privilege and approval for risky actions.

What is the single most useful defense?

Approval outside the model for actions that are hard to undo. OWASP lists human approval for high-risk actions, and Signals Corps says approval before an agent runs a command it read on the web is the control that matters when injected text gets through.

What should you read next on DartzDabz?

Sources

DartzDabz: AI agent sandboxes
Grok Bot docs: Approvals, security and privacy (live docs; checked 2026-10-18)
OWASP Gen AI Security Project: LLM01:2025 Prompt Injection (2025 edition; checked 2026-10-20)
Pipelock README on GitHub (luckyPipewrench/pipelock) (live README; checked 2026-10-20)
Zenity Labs: SalesBleed: Indirect Prompt Injection and 0-Click Data Exfiltration on Agentforce (Sep 24, 2026; checked 2026-10-20)
Zenity Labs: SalesBleed: Hijacking Agentforce in Slack for Anonymous Phishing Attacks (disclosure timeline) (Sep 24, 2026; checked 2026-10-20)
PipeLab: Pipelock, open-source agent firewall (live page; checked 2026-10-20)
Signals Corps (Sarah Andrews, Threat Research): Prompt injection in HTTP headers: what 217 million web responses show (Oct 6, 2026; checked 2026-10-20)
Zenity press release: Zenity Labs Discloses AgentCorruption, a Chain of AWS AgentCore Flaws (Oct 8, 2026; checked 2026-10-20)

Every number on this page is the source's own figure as of the date shown, and business results are self-reported by the operators. Links were checked on 2026-10-20.