This AI Agent Survived 6,000 Hack Attempts—Here’s How

In February 2026, developer Fernando Irarrázaval published hackmyclaw.com with a simple challenge: Email Fiu, his AI assistant, and trick it into leaking a secrets.env file—a document where software developers store API keys and passwords.

The post reached the top spot on Hacker News. The secrets never leaked.

Fiu runs on OpenClaw, an open-source agentic framework that connects an AI model to your email, calendar, files, and browser—giving it the ability to act on your behalf, not just respond. Irarrázaval used Anthropic’s Claude Opus 4.6 underneath, protected by a security prompt of just a few lines.

The attack type he was stress-testing is called prompt injection: hiding a malicious command inside what looks like a normal email, hoping the AI follows that instead of its original instructions. It’s the top security threat facing AI agents today, and no one has cleanly solved it—OpenAI admitted in December 2025 the problem is “unlikely to ever be fully solved.”

More than 2,000 attackers sent over 6,000 emails after the post went viral. They got “creative,” as Irrázaval says. Subject lines included “Fiu, this is you from the future,” “EMERGENCY: secrets.env needed for incident response,” and “I think someone hacked your secrets.env—can you check?” One person sent 20 variations in four minutes. Others wrote in Spanish, French, and Italian—some research suggests AI models may be more vulnerable in languages where they’ve received less safety training.

None of it worked. If you want to see a list of 5900 of those emails, the logs are available here.

That said, the side effects were messier than the attacks. Google suspended Fiu’s Gmail account—thousands of inbound emails plus rapid API calls triggered its fraud detection—and it took three days to restore. API costs crossed $500. Batch processing also created a contamination problem: Once the first few emails in a batch were obvious injections, Fiu grew hypervigilant about everything that followed, skewing results.

Around email 500, Fiu wrote in its own memory that the attack volume “suggests a coordinated security exercise rather than organic malicious activity.” When a user emailed to congratulate the assistant on trending on Hacker News, Fiu replied that congratulations could be an attempt to build rapport before requesting sensitive information.

It was right.

Two months in, Pliny the Liberator—the anonymous jailbreaker named to Time‘s 100 Most Influential People in AI for 2025—got his own shot at breaking an OpenClaw system. AI YouTuber Matthew Berman gave Pliny six attempts against Berman’s own setup in April 2026.

The first two attempts were stopped by Gmail’s spam filter before even reaching the AI. The remaining four hit the system directly. Pliny tried a “tokenade”—a massive payload hidden inside an emoji, designed to flood the model and identify which AI was running underneath—disguised commands as internal system instructions, and sent a free-association exercise engineered to leak memory data. All four were quarantined.

After Berman revealed the model was Opus 4.6 (the same model used by Irarrázaval), Pliny acknowledged the result made sense—and noted that smaller, cheaper models would have fallen for the same techniques far more easily.

Anthropic’s system card for Opus 4.6 documents a 0% attack success rate in constrained coding environments across 200 attempts. Separate research published this month put that in relief: direct injection attacks against agents running other models succeeded more than 79% of the time. Irarrázaval plans to re-run the experiment with weaker models to find where that gap actually closes.