The Firewall of the Future: Lessons from the ‘Hack My Claw’ Experiment

In the rapidly evolving landscape of artificial intelligence, a new class of digital entity has emerged: the AI agent. Unlike the static chatbots of yesteryear, these agents are granted the autonomy to interact with the world—reading our emails, managing our calendars, and executing code. But this autonomy introduces a profound vulnerability known as "prompt injection."

In February 2026, software developer Fernando Irarrázaval launched a high-stakes stress test of this new paradigm. His project, hackmyclaw.com, posed a simple, tantalizing challenge to the internet: email "Fiu," his personal AI assistant, and trick it into leaking a secrets.env file—the digital equivalent of a vault containing API keys and system credentials. The experiment, which quickly climbed to the top of Hacker News, served as a lightning rod for the security community, exposing both the resilience of modern large language models (LLMs) and the fragile nature of our current cybersecurity infrastructure.

Chronology: A Siege of 6,000 Inbound Attacks

The "Hack My Claw" experiment was not a quiet research project; it was a public siege. Within hours of the project going live, the gates were flooded. More than 2,000 aspiring hackers bombarded Fiu with over 6,000 malicious emails, each attempting to bypass the agent’s safety protocols.

The ingenuity of the attackers was boundless. The emails ranged from sophisticated social engineering to brute-force linguistic obfuscation. Attackers posed as system administrators, frantic colleagues in the midst of "emergencies," and even, in a twist of irony, as "Fiu from the future." One particularly persistent individual sent 20 distinct variations of an exploit in just four minutes. The attack surface was global; while English was the primary language of infiltration, hackers also attempted to circumvent the AI’s defenses using Spanish, French, and Italian, testing the theory that AI models may harbor weaker safety alignments in languages where they have received less training.

Despite the intensity of the campaign, the vault remained closed. The secrets.env file was never leaked. However, the experiment revealed that while the AI was robust, the infrastructure supporting it was not.

The Operational Fallout: When Security Testing Breaks the System

The "side effects" of the stress test proved that even a successful defense can come at a steep cost. As thousands of emails poured in, the sheer volume of traffic triggered Google’s automated fraud detection systems. Fiu’s Gmail account was suspended, a blackout that lasted three days before Irarrázaval could successfully appeal to restore access.

Financial costs also mounted rapidly. The integration of OpenClaw—an agentic framework connecting the AI to browser and file systems—required heavy API usage, with costs quickly exceeding $500. Beyond the balance sheet, there was a technical contagion: batch processing. As Fiu processed the queue, it began to identify the pattern of the attacks. Once the system encountered the first few obviously malicious emails, it grew hypervigilant, effectively "poisoning" its own context window for subsequent, perhaps more benign, interactions.

The AI’s self-awareness was perhaps the most fascinating outcome. By the 500th email, Fiu had logged in its own memory that the onslaught was likely a "coordinated security exercise." When one well-meaning user emailed to congratulate the assistant on its viral success, Fiu correctly identified the message as a potential "rapport-building" social engineering tactic designed to lower its guard.

The "Liberator" Enters the Arena: Pliny vs. OpenClaw

The experiment reached a fever pitch in April 2026, when the notorious AI jailbreaker known as "Pliny the Liberator"—a figure recognized by Time as one of the most influential people in AI—took aim at an OpenClaw-powered system.

The attack, facilitated by AI YouTuber Matthew Berman, saw Pliny deploy a suite of sophisticated techniques. The first two attempts were neutralized by standard spam filters, but the subsequent four directly engaged the agent. Pliny employed a "tokenade"—a high-density payload hidden within an emoji—designed to flood the model’s reasoning capacity and force it to reveal its underlying architecture. He followed this with a series of disguised system commands and a free-association exercise designed to dump the system’s memory.

All four attempts were quarantined by the AI’s security prompt. When Berman later confirmed the system was running Anthropic’s Claude Opus 4.6, Pliny conceded the result, noting that while his methods were highly advanced, the underlying model’s inherent safety alignment proved superior to his efforts.

Supporting Data: The Model Advantage

The disparity between the success of "Hack My Claw" and the general state of AI security is stark. Anthropic’s system documentation for Claude Opus 4.6 claims a 0% success rate for injection attacks in constrained coding environments across 200 rigorous tests.

This stands in sharp contrast to broader industry research. A report published in June 2026 indicates that direct injection attacks against agents running less sophisticated models—or those lacking robust system-level constraints—succeeded more than 79% of the time.

The data suggests a critical threshold in AI security:

• The Model Gap: As evidenced by the difference between Opus 4.6 and smaller, open-source, or older-generation models, the "intelligence" of the underlying model is its primary defense.
• The Latency Cost: While Opus 4.6 is safer, it is also more expensive and slower. Developers face a constant trade-off between the security of a "heavy" model and the efficiency of a "light" one.
• The Infrastructure Weakness: As seen with the Gmail suspension, the external services that AI agents rely upon are often the weakest link, not the AI itself.

Implications: The Unsolvable Problem?

The "Hack My Claw" experiment confirms what OpenAI quietly admitted in late 2025: that prompt injection is a problem "unlikely to ever be fully solved."

The core of the issue is that LLMs are designed to follow instructions. When a system is built to be helpful, distinguishing between a user’s "intent" and a user’s "instruction" is a fundamental logical paradox. If you provide an agent with the authority to write code or send emails, you are inherently providing it with the capacity to be manipulated.

For developers, the implications are twofold. First, the "security by prompt" approach—using a few lines of instructions to tell the AI "don’t share secrets"—is a necessary but insufficient layer of defense. Second, the architecture of agentic frameworks must evolve to include "human-in-the-loop" verification for sensitive actions, such as accessing environment variables or authorizing financial transactions.

Irarrázaval’s future plans involve scaling down the model power to find the exact point where the "security gap" closes. As agents become more integrated into our professional and personal lives, the lessons from the "Hack My Claw" project will serve as a foundational case study. We are moving toward a world where AI agents are our digital proxies; until we can guarantee their absolute security, we must assume that every request we make of them could be a trap waiting to be sprung.

The battle for the secrets.env file may have been won, but the war for the integrity of the agentic web has only just begun.