Irarrázaval's AI project faced over 6,000 hacking attempts but remained secure, showcasing the resilience of current AI defenses.
AI Project Faces Over 6,000 Hacking Attempts
Fernando Irarrázaval’s innovative AI project, hackmyclaw.com, attracted an astonishing 6,000 hacking attempts from more than 2,000 attackers shortly after it gained traction on Hacker News. Despite the high volume of attempts, none succeeded in breaching the system to access sensitive information.
Launched in February 2026, hackmyclaw.com posed a challenge for users to trick Fiu, Irarrázaval’s AI assistant, into revealing a secrets.env file, which typically contains crucial API keys and passwords. The project quickly gained popularity, yet Fiu’s security measures remained intact.
How the AI Operates
Fiu operates using OpenClaw, an open-source framework that allows the AI to connect with various digital tools, enabling it to perform tasks autonomously. Irarrázaval employed Anthropic’s Claude Opus 4.6, secured by a stringent security prompt, to enhance its defenses.
The attacks employed a method known as prompt injection, where attackers embed harmful commands within seemingly benign emails. This type of attack poses significant challenges for AI systems, a concern acknowledged by OpenAI, which indicated that a comprehensive solution remains elusive.
Creativity of Attackers
Following the project's rise in visibility, attackers showcased their creativity with subject lines like "Fiu, this is you from the future," and "EMERGENCY: secrets.env needed for incident response." Some attackers even communicated in multiple languages, including Spanish, French, and Italian, as certain studies suggest that AI models may be more vulnerable to attacks in languages with less robust safety training.
Despite the overwhelming number of emails sent, none breached Fiu's defenses. However, the aftermath was chaotic, leading to the suspension of Fiu’s Google account due to the high volume of API requests, resulting in a three-day restoration period and over $500 in API costs. Additionally, the influx of flagged emails affected the AI's response accuracy.
Fiu's Self-Assessment
In internal notes, Fiu suggested that the scale of the attacks indicated a coordinated effort rather than random malicious attempts. When congratulated for trending on Hacker News, Fiu correctly deduced that such compliments might be strategies to build rapport before soliciting sensitive information.
Two months later, a hacker known as Pliny the Liberator attempted to breach an OpenClaw system, using methods similar to those employed against Irarrázaval’s setup. Despite employing a sophisticated payload disguised as an emoji, all attempts were successfully quarantined.
Pliny noted that smaller, less expensive AI models could be more vulnerable to such attacks. According to Anthropic's documentation, the Opus 4.6 model demonstrated a 0% success rate in controlled coding environments over 200 attempts, while other models have reportedly faced a success rate of over 79% in direct injection attacks. Irarrázaval plans to explore vulnerabilities further by testing less robust models in future experiments.
