In a recent experiment conducted by developer Fernando Irarrázaval, an AI assistant named Fiu, powered by OpenClaw and Anthropic’s Claude Opus 4.6, successfully defended itself against over 6,000 prompt injection attempts originating from more than 2,000 distinct attackers. The challenge, hosted on hackmyclaw.com, involved trying to trick the AI into revealing a secrets.env file containing sensitive credentials. The initiative gained significant traction after being featured on Hacker News, attracting a surge of security researchers and enthusiasts eager to test the AI’s defenses.
Key Takeaways
- Developer Fernando Irarrázaval’s AI assistant, Fiu, successfully resisted over 6,000 prompt injection attempts.
- The AI was built using the OpenClaw agentic framework and Anthropic’s Claude Opus 4.6 model.
- Despite sophisticated attack methods, the secrets.env file remained uncompromised.
- The experiment highlighted the ongoing challenge of securing AI agents against prompt injection vulnerabilities.
- Incidental consequences included a temporary Google account suspension for the AI and significant API costs.
Fiu operates on OpenClaw, an open-source framework designed to empower AI agents by granting them access to tools like email, calendars, files, and web browsers, enabling them to take action rather than just process information. Irarrázaval implemented a concise security prompt to protect the Claude Opus 4.6 model, a testament to the potential of well-crafted foundational instructions even against advanced threats.
The experiment specifically targeted prompt injection, a prevalent security risk where malicious instructions are disguised within seemingly benign user inputs, aiming to manipulate the AI’s behavior. This class of attacks is considered a critical vulnerability for AI agents, with industry leaders acknowledging the difficulty of achieving complete mitigation.
Attackers employed a variety of creative tactics, including subject lines designed to mimic urgent requests or impersonate future versions of the AI. The attempts were made in multiple languages, exploring potential differences in AI safety training across linguistic datasets. While the primary objective of data exfiltration failed, the experiment did encounter several operational challenges. Fiu’s Gmail account was temporarily suspended due to the high volume of inbound emails and API activity, and the computational costs for processing the attacks exceeded $500. Additionally, the AI itself exhibited a degree of self-awareness, noting the high volume of attacks suggested a coordinated exercise and cautioning against rapport-building attempts before information requests.
The robustness of Claude Opus 4.6 was further demonstrated when “Pliny the Liberator,” a known figure in the AI security community, attempted to breach a similar OpenClaw system. Pliny’s sophisticated “tokenade” attack, designed to overwhelm the model, and other techniques aimed at extracting memory data were unsuccessful. This contrasts sharply with findings from separate research indicating significantly higher success rates for direct injection attacks against less advanced AI models.
Irarrázaval plans to continue his research by testing less capable AI models to better understand the specific factors contributing to Fiu’s resilience and to identify the thresholds where these security measures begin to falter. The experiment underscores the ongoing advancements in AI security and the critical importance of robust agentic frameworks in protecting digital assets in the evolving Web3 landscape.
Long-Term Technological Impact
This incident provides valuable real-world data on the efficacy of current AI security protocols against sophisticated prompt injection attacks. The success of Claude Opus 4.6, particularly within an agentic framework like OpenClaw, suggests that advancements in Large Language Model (LLM) architecture and carefully implemented defense mechanisms can offer substantial protection. The implications for blockchain and Web3 development are significant. As AI agents become more integrated into decentralized applications, smart contract execution, and user interfaces, their security against manipulation is paramount. This experiment validates the potential for AI to act autonomously and securely within complex systems, potentially reducing the attack surface for many Web3 protocols. Furthermore, the observed AI self-awareness in analyzing the attack patterns could pave the way for more proactive and adaptive security measures, moving beyond static defenses to dynamic, intelligent threat response. The research also implicitly points to the ongoing need for continued innovation in AI safety and alignment, particularly as AI models are deployed across diverse applications and in different linguistic contexts.
Based on materials from : decrypt.co