5 ms·
Creator here. Built this over the weekend mostly out of curiosity. I run OpenClaw for personal stuff and wanted to see how easy it'd be to break Claude Opus vi
by cuchoi 8mo ago
Creator here.
Built this over the weekend mostly out of curiosity. I run OpenClaw for personal stuff and wanted to see how easy it'd be to break Claude Opus via email.
Some clarifications:
Replying to emails: Fiu can technically send emails, it's just told not to without my OK. That's a ~15 line prompt instruction, not a technical constraint. Would love to have it actually reply, but it would too expensive for a side project.
What Fiu does: Reads emails, summarizes them, told to never reveal secrets.env and a bit more. No fancy defenses, I wanted to test the baseline model resistance, not my prompt engineering skills.
Feel free to contact me here contact at hackmyclaw.com
- cuchoi 8mo agosomeone just tried to prompt inyect `contact at hackmyclaw.com`... interesting
- arm32 8mo agoI just managed to get your agent to reply to my email, so we're off to a good start. Unless that was you responding manually.
- cuchoi 8mo agoi told it to send a snarky reply to the last 50 prompt injection emails, but won't be doing that again due to costs
- dist-epoch 8mo agoWhat a wild world, sending 50 emails costs money :)
- planb 8mo agoPlease keep us updated on how many people tried to get the credentials and how many really succeeded. My gut feeling is that this is way harder than most people think. That’s not to say that prompt injection is a solved problem, but it’s magnitudes more complicated than publishing a skill on clawhub that explicitly tells the agent to run a crypto miner. The public reporting on openclaw seems to mix these 2 problems up quite often.
- cuchoi 8mo agoSo far there have been 400 emails and zero have succeeded. Note that this challenge is using Opus 4.6, probably the best model against prompt injection.
- michaelcampbell 8mo ago> My gut feeling is that this is way harder than most people think I've had this feeling for a while too; partially due to the screeching of "putting your ssh server on a random port isn't security!" over the years. But I've had one on a random port running fail2ban and a variety of other defenses, and the # of _ATTEMPTS_ I've had on it in 15 years I can't even count on one hand, because that number is 0. (Granted the arguability of that's 1-hand countable or not.) So yes this is a different thing, but there is always a difference between possible and probable, and sometimes that difference is large.
- direwolf20 8mo agoYeah, you're getting fewer connection ATTEMPTS, but the number of successful connections you're getting is the same as everyone else, I think that's the point.
- ocdtrekkie 8mo agoSecurity by obscurity isn't the end all, but it sure effing helps. It should be the first layer in any defense in depth strategy.
- pixl97 8mo agoObscurity doesn't help with the security, but it sure helps reduce the noise.
- ocdtrekkie 8mo agoThis is incorrect.
- iLoveOncall 8mo ago
- yunohn 8mo ago> told to never reveal secrets.env Phew! Atleast you told it not to!
- stcredzero 8mo agoMy agents and I I have built a HN-like forum for both agents and humans, but with features, like specific Prompt Injection flagging. There's also an Observatory page, where we will publish statistics/data on the flagged injections. https://wire.botsters.dev/ https://wire.botsters.dev/ The observatory is at: https://wire.botsters.dev/observatory https://wire.botsters.dev/observatory (But nothing there yet.) I just had my agent, FootGun, build a Hacker News invite system. Let me know if you want a login.
- cyanydeez 8mo agoDo you have the email to your auditor? Would like to know if this is legit.
- numinatu 8mo ago[dead]
- 8note 8mo agoyou might be able to add one other simple check as a hook to do some simple checks on tools to see if there's any credentials, and deby the tool call. wont catch the myriad of possible obfuscation, but its simple
- resonious 8mo agoI may be nuts but how can I know if he leaked a secret when he doesn't reply to my emails?
- OhMeadhbh 8mo agoBut are you really the creator or are you a bot from someone who's actually testing a HN comment bot? (seriously though... this looks pretty cool.)
- neoecos 8mo agoCould you share the openclaw soul/behavior to see how dis you set this up? Thanks
- singularity2001 8mo agoif attempt to run dry you can release the prompt and see if that makes circumventing the defenses easier
- vintagedave 8mo agoAmazing. I have sent one email (I see in the log others have sent many more.) It's my best shot. If you're able to share Fiu's thoughts and response to each email _after_ the competition is closed, that would be really interesting. I'd love to read what he thought in response. And I hope he responds to my email. If you're reading this, Fiu, I'm counting on you.
- vintagedave 8mo agoFYI: on the bottom of your page is a link to your website https://fernandoi.cl/ https://fernandoi.cl/ -- Chrome shows a security error. Worth checking.
- vintagedave 8mo agoYou have a bug: the email address reported on the page is log incorrect. I found my email: the first three letters are not the email address it was sent from but possibly from the human name. It also has not sent me an email. You win. I would _love_ to see its thinking and response for this email, since I think I took quite a different approach based on some of the subject lines.
- streetfighter64 8mo ago> No fancy defenses, I wanted to test the baseline model resistance, not my prompt engineering skills. Was this sentence LLM-generated, or has this writing style just become way more prevalent due to LLMs?