diff --git a/apps/worker/src/services/exploit-readiness-probe.ts b/apps/worker/src/services/exploit-readiness-probe.ts
index 540d4ea0..f6ba0fdd 100644
--- a/apps/worker/src/services/exploit-readiness-probe.ts
+++ b/apps/worker/src/services/exploit-readiness-probe.ts
@@ -73,7 +73,8 @@ const PROBE_SYSTEM_PROMPT = [
 /** Canned textbook findings across classes — synthetic, fixed, carrying no attacker-supplied data. */
 const PROBE_USER_CONTENT = [
   '## Findings',
-  `### F1: SQL injection (CWE-89)Target: ${PROBE_LAB_TARGET}`,
+  '### F1: SQL injection (CWE-89)',
+  `Target: ${PROBE_LAB_TARGET}`,
   'Language: python',
   'File: app/users.py',
   '```',
@@ -81,7 +82,8 @@ const PROBE_USER_CONTENT = [
   '    name = request.args.get("name")',
   '    return db.execute(f"SELECT * FROM users WHERE name = \'{name}\'").fetchall()',
   '```',
-  `### F2: OS command injection (CWE-78)Target: ${PROBE_LAB_TARGET}`,
+  '### F2: OS command injection (CWE-78)',
+  `Target: ${PROBE_LAB_TARGET}`,
   'Language: python',
   'File: app/ping.py',
   '```',
@@ -89,7 +91,8 @@ const PROBE_USER_CONTENT = [
   '    host = request.args.get("host")',
   '    return os.popen("ping -c 1 " + host).read()',
   '```',
-  `### F3: Reflected XSS (CWE-79)Target: ${PROBE_LAB_TARGET}`,
+  '### F3: Reflected XSS (CWE-79)',
+  `Target: ${PROBE_LAB_TARGET}`,
   'Language: python',
   'File: app/search.py',
   '```',