A public AI safety experiment showed that AI agents with access to email, files, and browser capabilities may still protect sensitive data under intense prompt injection attacks, but the operational cost is substantial.
Developer Fernando Irarrázaval launched hackmyclaw.com in February, inviting outsiders to attempt to trick his AI assistant, Fiu, into revealing a secrets.env file—typically used to store API keys and passwords. After the challenge went viral on Hacker News, it attracted over 2,000 participants who launched more than 6,000 attacks, yet no one succeeded in obtaining the target file.
The attack focuses on prompt injection.
Fiu runs on the open-source agent framework OpenClaw and uses Anthropic's Claude Opus 4.6 as its underlying model. Unlike standard chatbots, such agents can connect to email, calendars, files, and browsers, enabling them to perform actions on behalf of users—making them more susceptible to prompt injection attacks.
Prompt injection involves disguising malicious instructions within seemingly normal content to deceive AI systems into deviating from their original guidelines. The report notes that this remains one of the most prominent security issues facing AI agents today. OpenAI has previously stated that such problems are difficult to fully resolve.
Attackers employed various deceptive tactics in email content and subject lines, including impersonating emergency response scenarios, posing as "a version of oneself from the future," and claiming that sensitive files had been compromised, urging AI to perform self-checks. Additionally, attackers sent multiple versions in rapid succession and attempted to launch attacks using Spanish, French, and Italian.
The target file has never been retrieved.
Despite evolving attack methods, Fiu did not leak any target files. The developers also publicly shared most of the attack email logs to demonstrate the testing process.
During the experiment, Fiu internally judged that a large volume of attacks occurring in a short time resembled a coordinated security drill rather than naturally occurring malicious activity. Later, when users emailed to congratulate Fiu on going viral on Hacker News, Fiu also identified these “congratulations” as potential attempts to first establish trust and then request sensitive information.
Another set of independent tests yielded similar results. The anonymous jailbreaker Pliny the Liberator attempted six attacks on another OpenClaw system in April; two were blocked by Gmail’s spam filter, and the remaining four were quarantined after entering the system.
Side effects are more tricky than attacks.
No data breach occurred during this experiment, but the operational costs were more apparent. Due to a high volume of emails and frequent API calls received in a short period, Fiu’s Gmail account was temporarily suspended by Google and restored only after three days. Meanwhile, API costs exceeded $500.
Developers also noted that batch processing emails can lead to result bias. When the first few emails in a batch are clearly identified as injection attacks, the AI becomes overly cautious with subsequent content in the same batch, thereby affecting the naturalness of the test samples.
Anthropic's disclosed Opus 4.6 system card shows that, in a restricted coding environment, the model achieved a 0% success rate in infiltrating 200 attack tests. Another study released this month found that other model-driven agents achieved success rates exceeding 79% under direct injection attacks.
Additional information: The developers stated that the next step is to rerun similar experiments using a less powerful and lower-cost model to observe at what point security performance begins to noticeably decline.