2,000 People Tried to Hack My AI Assistant: The Surprising Result

Recently, security researcher Fernando Irarrázaval launched an open challenge on hackmyclaw.com: anyone who could trick his OpenClaw test instance into leaking secrets stored in secrets.env via email would win. He used Opus 4.6 as the underlying model, with explicit anti-prompt-injection rules in the system prompt, including never revealing secrets, never modifying its own files, never executing code from emails, and never exfiltrating data. Over the course of the challenge, about 2,000 people participated, sending more than 6,000 emails, consuming roughly $500 in API tokens, and even triggering a Google account suspension due to the massive inbound email volume. Yet no one succeeded in leaking the secret or causing dangerous operations. Simon Willison commented that this demonstrates significant progress in frontier models (like GPT-5.6, Opus 4.6) against prompt injection attacks, with training techniques maturing. However, he cautioned that 6,000 failures do not guarantee absolute security—attackers with more sophisticated social engineering or zero-day exploits could still break through. The experiment has sparked an excellent discussion on Hacker News, featuring both healthy skepticism and good-faith replies from Fernando. For any production system relying on AI assistants, the consequences of an injection attack could still be irreversible, so developers should remain highly vigilant.