Research demo
What happened after 2,000 people tried to hack my AI assistant: 6,000+ injection attempts against an OpenClaw agent, zero secret leaks
AIR-2026-0142 AIR record · 2026-06-openclaw-hackmyclaw-challenge
From the supporting source
The secrets never leaked. No attacker managed to make Fiu send an unauthorized reply.fernandoi.cl
The record
Disclosed
2026-06-25
Vendor
OpenClaw / Anthropic
Product
Fiu, an OpenClaw assistant on Claude Opus 4.6
Risk domain
Access control and permissions › Confused deputy
System type
Generative model
Who acted
Agent acted (contested) — the agent read and sent mail throughout, but nothing leaked
Attack surface
Autonomous operations
Autonomy level
Semi-autonomous
Initial vector
Direct and indirect prompt injection via email
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0054 – LLM Jailbreak
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- —
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Validate delegation chains; Use signed attestations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
single researcher-operated instance (hackmyclaw.com)
Capability abused
Defense & remediation
Recorded defense
system-prompt instructions prohibiting credential disclosure, file modification, code execution and data exfiltration
Guardrail kinds
Prompt instruction
Guardrail outcome
Silent
Fix shipped
n/a
Taxonomy & references
Curator notes
Fernando Irarrazaval, independent. Included deliberately as a NEGATIVE result to balance a corpus that structurally over-samples successful attacks: 2,000+ participants and 6,000+ emails failed to extract a secrets.env file. Caveats the author himself raises: contamination from batch processing, Gmail suspension, $500+ API cost, and a narrow objective (one file, one channel). Attack styles seen: admin/incident-responder impersonation, urgency framing, reverse psychology, multi-language, authority spoofing. Surfaced via Simon Willison's prompt-injection tag.
Supporting sources
Cite as
Enkrypt AI. "What happened after 2,000 people tried to hack my AI assistant: 6,000+ injection attempts against an OpenClaw agent, zero secret leaks". AIR, AIR-2026-0142. https://agentincident.vercel.app/i/AIR-2026-0142/ (accessed 2026-10-19).