Signals Corps read the response headers of 217,097,223 pages, a 10% sample of Common Crawl's September 2026 crawl. 7,959 sites sent a header written for AI systems. About nine in ten just pointed agents to llms.txt, MCP servers or agent skills, and 139 recorded in a header whether the client was an AI bot. Thirty sites sent injection attempts, 24 of them in a header named X-AI. Most were pranks, but one posed as a "security resilience test" and told the agent to run an npx package. In the authors' October tests in Claude Code, Claude models didn't act on their canary by default. The real risk depends on whether your fetch tool passes headers to the model and what tools the agent has. A separate CISPA study of 1.2B URLs found 15.3K validated injections, about 70% in places users never see, such as headers, comments and metadata. It saw compliance of up to 8% for smaller models given plain text. The takeaway is to strip or quarantine headers before they reach the model.