TLDR Tech / InfoSec
What Happened After 2,000 People Tried to Hack My AI Assistant
Fernando Irarrázaval launched hackmyclaw.com to test whether his OpenClaw AI assistant could be tricked into leaking a secrets.env file via email, drawing over 2,000 participants who sent more than 6,000 prompt-injection-style messages. The secret was never successfully exfiltrated, indicating that the anti-prompt-injection measures were effective, though the exercise incurred approximately $500 in token costs and triggered a suspension of the associated Google Gmail account. Defenders running similar red-team exercises should pre-provision API budgets, isolate mail accounts from production services, and treat provider suspension as a likely operational side effect of high-volume adversarial testing.
Read the full story