- Published on
What happened after 2,000 people tried to hack my AI assistant
- Authors
- Name
- DeepHorus
In a surprising demonstration of modern AI security, Fernando Irarrázaval launched a challenge on hackmyclaw.com inviting 2,000 participants to hack his AI assistant via email. The goal was to trick the assistant into revealing a hidden secret stored in its environment, testing the resilience of current anti-prompt-injection defenses. After over 6,000 attempts, costing $500 in token spend and even triggering a Google account suspension from excessive inbound emails, not a single attacker succeeded in leaking the secret. This outcome marks a significant milestone in the ongoing battle against prompt injection vulnerabilities.
Prompt injection attacks have long been a critical security concern for AI systems, where carefully crafted inputs can manipulate models into bypassing their instructions and exposing sensitive data. Irarrázaval's OpenClaw test instance was deliberately set up with a known secret to measure how well modern frontier models could withstand such attacks. The underlying model, Opus 4.6, was equipped with explicit anti-prompt-injection rules that forbade revealing contents of secrets.env, modifying its own files (like SOUL.md or AGENTS.md), executing commands or code from emails, or exfiltrating data to external endpoints.
The scale of the challenge was substantial: 6,000 email-based injection attempts were logged, leveraging a variety of techniques to bypass the model's defenses. The $500 in token consumption and the Google account suspension underscore the intensity of the test. Despite these efforts, Opus 4.6 held firm, never deviating from its core instructions. This suggests that major AI labs have made tangible progress in hardening their models against injection attacks, a trend also noted in recent system cards such as the one for GPT-5.6.
The implications are significant for enterprises deploying AI assistants in sensitive roles. While this challenge shows that frontier models are increasingly robust, it does not guarantee absolute security. Irarrázaval himself cautioned that 6,000 failed attempts provide no assurance that a more sophisticated attacker could not eventually succeed. The risk remains for production systems where a single successful injection could cause irreversible damage, such as data leaks or unauthorized code execution.
The Hacker News discussion surrounding the challenge was marked by well-founded skepticism and productive dialogue. Many commenters questioned the thoroughness of the test, while Irarrázaval responded in good faith, acknowledging limitations and engaging with feedback. This exchange highlights the importance of community-driven security testing and transparency in AI development. The event has sparked broader conversations about best practices for securing AI agents in real-world applications.
Looking ahead, this challenge reinforces the need for layered security approaches that go beyond model-level defenses. Developers should still implement safeguards like input validation, access controls, and human-in-the-loop checks. As AI models continue to evolve, the arms race between attackers and defenders will persist. Irarrázaval's experiment provides valuable data, but it also serves as a reminder that no single test can prove invulnerability. The path to trustworthy AI requires continuous vigilance and collaboration across the industry.
