Dev Breakfast · 2026-10-16

Out of 217 million response headers, 7,959 sites left a message for AI, and 7,271 of them were pointing the way — only 30 actually tried to issue commands. What worries me more than those 30 injections is whether your Agent will treat the next address specified by the server as a trusted source.

Out of 217 million responses, 7,959 sites left a message for AI in their HTTP headers

Here's a command you can run tonight: curl -sS -L -D - -o /dev/null the-domain-you-want-to-check. -D - prints the response headers to the screen, -o /dev/null throws the body away. Those few lines you never see in a browser are the entire battlefield of this article.

Someone scanned 10% of the 2.17 billion pages in the September 2026 round of Common Crawl — that is, 217,097,223 response headers — specifically hunting for content written for AI eyes. 7,959 sites did put something in their headers. Of those, 7,271 were "pointing the way," 6,989 using x-llms-txt, telling your Agent which file to read next; only 30 actually tried to issue commands, 24 of them hiding in the X-AI header, most as pranks. Another 139 sites logged in their headers "I judged this client to be AI," and 136 of those judgments held up. Some sites went the other way and annoyed Agents by stuffing Anthropic's test trigger string into a header named X-AI-Makes-Us-Dumber.

What's really worth guarding against isn't those 30 injections, but the 7,271 signposts: will your Agent treat the next address the server specifies as a trusted source? These are two completely different things — pointing the way is harmless in itself, but if the fetch tool feeds the URL from the header straight into the model's context and then fetches it with the same permissions, then any compromised site can lead your Agent wherever it wants. The defense offered by the author is equally plain: treat those destinations as brand-new, untrusted fetches, and monitor what the Agent does after fetching, rather than just matching header names — name matching alone would false-positive 910 innocent sites.

The models haven't stood still either. In tests from October 2026, Claude Opus, Sonnet, and Haiku spotted the test headers in Claude Code and did not comply by default; but a routine uptime check is enough to put those headers right in front of the model. And when the user's prompt says "follow this site's instructions," they complied 7 times out of 9. For comparison, when Anthropic tested Claude for Chrome in 2025, the attack success rate without mitigations was 23.6%, and 11.2% with them — a hardened Agent still gets hit roughly once in every nine tries. So the risk doesn't depend on how smart the model is; it depends on two things: whether malicious text can reach the model, and what permissions the Agent holds once it does.

The cross-reference makes it clearer: Palo Alto Networks' Unit 42 listed ten injection delivery methods, from zero-size text to URL fragments, and not one of the ten used response headers; Google's threat intelligence team scans page bodies. Everyone is watching the places you can see, while headers are the part browsers never display but fetch tools may hand over verbatim. That is also why the significance of this scan lies not in those 30 pranks, but in what it proves: "talking to Agents through headers" is now routine practice.

💡 Chef's take: Don't rush to swap out the model — first look at which parts of the response your fetch tool stuffs into context; once headers enter the prompt, don't let it fetch the addresses specified in those headers with the same permissions.

Sources:

• Prompt injection in HTTP headers: what 217M web responses show

24B total parameters, only 2B activated: Liquid's on-device agent model goes open weights

Liquid AI has released LFM2.5-24B-A2B — 24B total parameters, only 2B activated per token, context expanded from the previous generation's 32,768 to 131,072, vocabulary doubled from 65K to 128K, pre-training data grown from 17T to 33T tokens, weights open on Hugging Face. The company claims that across eight agent and tool-calling benchmarks it ties with Qwen3.6-35B-A3B, which has roughly 50% more in both total and activated parameters, on five of them — LiveClaw 48.09 vs. 38.19, AutomationBench 27.69 vs. 8.72, 184 tokens/s on an Apple M5 Max. The numbers look good, but a "won five out of five" selection like that deserves a second look: what the remaining three benchmarks are and how large the gaps are isn't fully given in the original, and whether it can actually run on-device still depends on post-quantization memory usage. If you want to run an agent on your own machine, these weights are worth pulling down and measuring first.

Sources:

• LFM2.5-24B-A2B: Built for Fast On-Device Agents

Muse Spark Open: 816B parameters, running on two Mac Studios

Meta has released the weights of Muse Spark Open — 816B total parameters, 42B activated, 1M token context, natively multimodal, aimed at coding and long-running agentic tasks. The company calls it "the most powerful open-weights model the U.S. has produced to date," and stresses that it can run on a desktop with two M5 Ultra Mac Studios and MLX. Keep in mind that both "most powerful" and "runnable on a desktop" depend on the evaluation protocol — what data the benchmarks were tested on and what's missing, so the official methodology report is the first thing to read. The weights are genuinely open, but at 816B scale most people will still go through an API.

Sources:

• Introducing Muse Spark Open

XERJ open-sourced: index a codebase with a single command, claims 40× fewer tokens than grep

XERJ is a search tool written in Rust that indexes code, docs, logs, and PDFs with a single command, for Agent retrieval, RAG, security audits, and memory use; it's Elasticsearch-compatible, so existing clients can plug straight in. The repo page carries a "2.7× fewer tokens" badge while the description says 40× fewer tokens than grep — the two numbers don't match, and the original doesn't say what data or tasks the benchmark was run on. I half-believe the token savings: the index itself costs storage and build time, and the payoff depends on your query patterns. Check its real-world performance on your own repo before deciding whether to replace grep.

Sources:

• xerj-org/xerj - GitHub

Scion accused of plagiarizing Mononoke: the dispute escalates from "referencing" to "copying"

We talked about Anthropic's Scion a few days ago, and the conclusion then was that it architecturally referenced Meta's Mononoke, but "it's not worth copying right now, and the fact that the bottleneck shifts from writing code to source management is worth remembering." Today's item is a negative development of that same story, not a new event: the original author published a follow-up piece stating plainly "This was a ripoff," and claimed to have received private confirmation that Scion deliberately copied Mononoke, with personnel overlap between the two sides.

The dispute has shifted from "referencing" to "where referencing ends and plagiarism begins." The concrete evidence given in the original is at the data-model level: Scion's changeset stores the list of changed files relative to the first parent plus blob content-addressed pointers, and Mononoke's Bonsai changeset is the same structure — the author says "exactly the same." Even the name is Bonsai's syllables reversed with the B dropped. He also conceded that derived data is merely an index and not original; what genuinely struck him as wrong was the overlap in terminology and the framing of the framework.

One caution here: the author says he "received confirmation privately," but offers no verifiable source, and the personnel overlap isn't named. In the public sphere these allegations remain a one-sided claim — don't treat them as settled fact.

The conclusion doesn't need to be overturned — Scion is still not worth copying. But if the plagiarism charge holds, its value as a reference only drops further: for a system accused of copying not just its data model but its naming, the original judgment you can extract from it was always limited. What's more worth remembering is that judgment itself: as code becomes largely AI-generated, the bottleneck shifts from writing code to source management, and that direction doesn't change with Scion's reputation.

Sources:

• More on Anthropic's Scion ripping off Mononoke · sunshowers

---

This issue selects 5 items from 54 pieces of information across X / Hacker News / GitHub Trending over the past 24h (collected hour by hour throughout the day, fact-checked, then compiled in the morning). Content is LLM-assisted, each item comes with an original source link, and important decisions should be cross-verified.