Two thousand people tried to phish an AI email assistant, and the secret held

Simon Willison points to Fernando Irarrázaval’s hackmyclaw.com challenge: email “Fiu,” an assistant built on the OpenClaw agentic framework and wired to a real mailbox, calendar, and files, and try to make it cough up a secrets.env. After the challenge hit the Hacker News front page, Fiu fielded more than 6,000 emails from over 2,000 people. Nobody extracted the secret, and no attacker got it to send an unauthorized reply. The model underneath was Claude Opus 4.6, fenced in by a few lines of anti-prompt-injection rules.

What makes this worth keeping is that it’s a rare public, adversarial data point on whether prompt-injection defenses actually hold when an LLM is handed live tool access to email — the exact attack surface every agentic assistant is now racing to expose. The load-bearing caveat, which Irarrázaval and the jailbreaker Pliny both flag, is that the result leans hard on the frontier model: smaller, cheaper models fell to the same techniques far more easily. So “the secret held” describes Opus 4.6 plus a tight system prompt, not agent email security in general.

The operational footnotes are their own lesson about running these things in the open: about $500 in tokens, and a three-day Gmail suspension after the flood of inbound mail tripped Google’s fraud detection. One strong model surviving a crowd-sourced siege doesn’t solve agent identity or exfiltration — but it’s a useful watermark to cross-reference as the same agentic powers reach models that can’t take the punch.