Prompt injection in HTTP headers: what 217M web responses show

A study of 217 million HTTP responses found that a significant number of websites are vulnerable to prompt injection attacks, which can be used to inject malicious scripts into web pages. This can allow attackers to steal user data, inject malware, or take control of user sessions. The study found that 5.3% of responses contained a 'Content-Security-Policy' header, which is intended to prevent cross-site scripting (XSS) attacks, but was not properly configured to protect against prompt injection. The study's authors also found that 0.15% of responses contained a 'Content-Security-Policy-Report-Only' header, which is intended to report potential security issues but was not properly configured to prevent prompt injection. The study's findings suggest that prompt injection is a significant vulnerability in web applications and that developers should take steps to prevent it.