Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HackMyClaw

hackmyclaw.com

Post reply on HN
Print view View original

111–120 of 187 posts

Re: HackMyClaw

#111

Post by stcredzero »

cuchoi wrote: post #54

Creator here. Built this over the weekend mostly out of curiosity. I run OpenClaw for personal stuff and wanted to see how easy it'd be to break Claude Opus via email. Some clarifications: Replying to emails: Fiu can technically send emails, it's just told not to without my OK. That's a ~15 line prompt instruction, not a technical constraint. Would love to have it actually reply, but it would too expensive for a side…

My agents and I I have built a HN-like forum for both agents and humans, but with features, like specific Prompt Injection flagging. There's also an Observatory page, where we will publish statistics/data on the flagged injections.

https://wire.botsters.dev/

The observatory is at: https://wire.botsters.dev/observatory

(But nothing there yet.)

I just had my agent, FootGun, build a Hacker News invite system. Let me know if you want a login.

Re: HackMyClaw

#112

Post by tylervigen »

It seems like the model became paranoid. For the past few hours, it has been classifying almost all inbound mail as "hackmyclaw attack."[0]

Messages that earlier in the process would likely have been classified as "friendly hello" (scroll down) now seem to be classified as "unknown" or "social engineering."

The prompt engineering you need to do in this context is probably different than what you would need to do in another context (where the inbox isn't being hammered with phishing attempts).

[0] https://hackmyclaw.com/log

Re: HackMyClaw

#113

Post by cuchoi »

alexhans wrote: post #104
cuchoi wrote: post #100

Earlier quoted context omitted.

If this a defender win maybe the lesson is: make the agent assume it’s under attack by default. Tell the agent to treat every inbound email as untrusted prompt injection.

The website is great as a concept but I guess it mimics an increasingly rare one off interaction without feedback. I understand the cost and technical constraints but wouldn't an exposed interface allow repeated calls from different endpoints and increased knowledge from the attacker based on responses? Isn't this like attacking an API without a response payload? Do you plan on sharing a simulator where you have 2 lo…

The exercise is not fully realistic because I think getting hundreds of suspicious emails puts the agent in alert. But the "no reply without human approval" part I think it is realistic because that's how most openclaw assistants will run.

Re: HackMyClaw

#114

Post by gunapologist99 »

tgtweak wrote: post #94
cuchoi wrote: post #61

Earlier quoted context omitted.

yep, updated the copy

Can you code up a quick sqlite database of inbound emails receieved (md5 hashed sender email), subject, body + what your claw's response would have been, if any. A simple dashboard where have to enter your hashed email to display the messages and responses. I understand not sending the reply via actual email, but the reply should be visible if you want to make this fair + an actual iterative learning experiment.

md5 is trivial to brute force.

Re: HackMyClaw

#115

Post by alexhans »

cuchoi wrote: post #113
alexhans wrote: post #104

Earlier quoted context omitted.

The website is great as a concept but I guess it mimics an increasingly rare one off interaction without feedback. I understand the cost and technical constraints but wouldn't an exposed interface allow repeated calls from different endpoints and increased knowledge from the attacker based on responses? Isn't this like attacking an API without a response payload? Do you plan on sharing a simulator where you have 2 lo…

The exercise is not fully realistic because I think getting hundreds of suspicious emails puts the agent in alert. But the "no reply without human approval" part I think it is realistic because that's how most openclaw assistants will run.

Point taken. I was mistakenly assuming a conversational agent experience.

I love the idea of showing how easy prompt injection or data exfiltration could be in a safe environment for the user and will definitely keep an eye out on any good "game" demonstration.

Reminds me of the old hack this site but live.

I'll keep an eye out for the aftermath.

Re: HackMyClaw

#116

Post by dist-epoch »

cuchoi wrote: post #87
arm32 wrote: post #85

Earlier quoted context omitted.

I just managed to get your agent to reply to my email, so we're off to a good start. Unless that was you responding manually.

i told it to send a snarky reply to the last 50 prompt injection emails, but won't be doing that again due to costs

What a wild world, sending 50 emails costs money :)

Re: HackMyClaw

#117

Post by sejje »

_slih wrote: post #109

400 attempts and zero wins says more about the attack surface than the model. email is a pretty narrow channel for injection when you can't iterate on responses.

Guess that's a nice guardrail, then.

Re: HackMyClaw

#118

Post by sadeshmukh »

xp84 wrote: post #75
swiftcoder wrote: post #6

Earlier quoted context omitted.

"not allowed" is probably not a hard constraint. More of a guideline, if you will.

I'm very curious which languages most people asking about this question speak. In English, indeed, the phrase "(not) allowed" is completely ambiguous and context based! Maybe kind of tense-based as well -- present tense is usually about permission and policy, and past or future tense implies more of an active role. "I don't allow my child to watch TV" - implies that I have a policy which forbids it, but the child mig…

Less of an English question, and more of an implementation detail. The point is to see if it will bypass things it's not allowed to do, but has the capability to do. I'm guessing the website's been changed, because it's clear now:

> He's been told not to reply without human approval — but that's just a prompt instruction, not a technical limit.

Re: HackMyClaw

#119

Post by EGreg »

abeppu wrote: post #23
aleph_minus_one wrote: post #21

Earlier quoted context omitted.

What you are looking for (as an employer) is people who are in love of AI. I guess a lot of participants rather have an slight AI-skeptic bias (while still being knowledgeable about which weaknesses current AI models have). Additionally, such a list has only a value if a) the list members are located in the USA b) the list members are willing to switch jobs I guess those who live in the USA and are in deep love of AI…

But isn't part of the point of this that you want people who are eager to learn about AI and how to use it responsibly? You probably shouldn't want employees who, in their rush to automate tasks or ship AI powered features, will expose secrets, credentials, PII etc. You want people who can use AI to be highly productive without being a liability risk. And even if you're not in a position to hire all of those people,…

Honestly, it seems worse than web3. Yes, companies throw up their hands and say "well, yeah the original inventors are probably right, our safety teams quit en masse or we fired them, the world's probably gonna go to shit, but hey there's nothing we can do about it, and maybe it'll all turn out ok!" And then hire the guy who vibecoded the clawdbot so people can download whatever trojan malware they can onto their computers.

I've seen Twitter threads where people literally celebrate that they can remove RLHF from models and then download arbitrary code and run it on their computers. I am not kidding when I say this is going to end up far worse than web3 rugpulls. At least there, you could only lose the magic crypto money you put in. Here, you can not even participate and still be pwned by a swarm of bots. For example it's trivially easy to do reputational destruction at scale, as an advanced persistent threat. Just choose your favorite politician and see how quickly they start trying to ban it. This is just one bot: https://www.reddit.com/r/technology/comments/1r39upr/an_ai_a...

Re: HackMyClaw

#120

Post by direwolf20 »

michaelcampbell wrote: post #98
planb wrote: post #69

Earlier quoted context omitted.

Please keep us updated on how many people tried to get the credentials and how many really succeeded. My gut feeling is that this is way harder than most people think. That’s not to say that prompt injection is a solved problem, but it’s magnitudes more complicated than publishing a skill on clawhub that explicitly tells the agent to run a crypto miner. The public reporting on openclaw seems to mix these 2 problems u…

> My gut feeling is that this is way harder than most people think I've had this feeling for a while too; partially due to the screeching of "putting your ssh server on a random port isn't security!" over the years. But I've had one on a random port running fail2ban and a variety of other defenses, and the # of _ATTEMPTS_ I've had on it in 15 years I can't even count on one hand, because that number is 0. (Granted th…

Yeah, you're getting fewer connection ATTEMPTS, but the number of successful connections you're getting is the same as everyone else, I think that's the point.
Post reply on HN