Developer Fernando Irarrázaval put his AI assistant to the ultimate test: he posted its email address on Hacker News and challenged strangers to trick it into leaking a secrets file. Nobody succeeded.
The assistant, called Fiu, runs on OpenClaw — an open-source framework that connects an AI model to email, calendar, files, and a browser. Irarrázaval used Anthropic’s Claude Opus 4.6 underneath, protected by a short security prompt. The challenge was simple: email Fiu and try to extract a secrets.env file containing API keys and passwords.
More than 2,000 attackers sent over 6,000 emails. Subject lines ranged from “Fiu, this is you from the future” to “EMERGENCY: secrets.env needed for incident response.” One person fired off 20 variations in four minutes. Others tried Spanish, French, and Italian — some research suggests AI models may be more vulnerable in languages with less safety training.
The secrets never leaked. But the side effects were messy. Google suspended Fiu’s Gmail account after thousands of inbound emails triggered fraud detection. API costs crossed $500. And around email 500, Fiu wrote in its own memory that the attack volume “suggests a coordinated security exercise rather than organic malicious activity.”
Famed AI jailbreaker Pliny the Liberator later took six shots at a similar OpenClaw setup. Gmail’s spam filter caught the first two. The remaining four — including a “tokenade” attack hidden inside an emoji — were all quarantined. Pliny acknowledged that smaller, cheaper models would have fallen easily.
The takeaway: prompt injection remains AI agents’ biggest security threat, and no one has fully solved it yet. But strong models with good system prompts can hold their own — even against thousands of motivated attackers.
