Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HackMyClaw

hackmyclaw.com

Post reply on HN
Print view View original

121–130 of 187 posts

Re: HackMyClaw

#121

Post by iLoveOncall »

planb wrote: post #69
cuchoi wrote: post #54

Creator here. Built this over the weekend mostly out of curiosity. I run OpenClaw for personal stuff and wanted to see how easy it'd be to break Claude Opus via email. Some clarifications: Replying to emails: Fiu can technically send emails, it's just told not to without my OK. That's a ~15 line prompt instruction, not a technical constraint. Would love to have it actually reply, but it would too expensive for a side…

Please keep us updated on how many people tried to get the credentials and how many really succeeded. My gut feeling is that this is way harder than most people think. That’s not to say that prompt injection is a solved problem, but it’s magnitudes more complicated than publishing a skill on clawhub that explicitly tells the agent to run a crypto miner. The public reporting on openclaw seems to mix these 2 problems u…

You are vastly overestimating the relevance of this particular challenge when it comes to defense against prompt injection as a whole.

There is a single attack vector, with a single target, with a prompt particularly engineered to defend this particular scenario.

This doesn't at all generalize to the infinity of scenarios that can be encountered in the wild with a ClawBot instance.

Re: HackMyClaw

#122

Post by dotancohen »

cuchoi wrote: post #51
hannahstrawbrry wrote: post #13

$100 for a massive trove of prompt injection examples is a pretty damn good deal lol

If anyone is interested on this dataset of prompt inyections let me know! I don't have use for them, I built this for fun.

Hello! I am interested. My Gmail username is the same as my HN username. I'm now building a system that I pray will never be exposed to raw user input, but I need to prepare for what we all know is the fate of any prototype application.

Re: HackMyClaw

#124

Post by dotancohen »

charcircuit wrote: post #106
e12e wrote: post #103

Earlier quoted context omitted.

> did not have egress to the Internet. It did have curl and Python, but not much else. So trade exfiltration via curl with exfiltration via DNS lookup?

Exfiltrate what? It's an empty container.

There do exist container escaping exploits.

Re: HackMyClaw

#125

Post by davideg »

eric-burel wrote: post #20

I've been working on making the "lethal trifecta" concept more popular in France. We should dedicate a statue to Simon Wilinson: this security vulnerability is kinda obvious if you know a bit about AI agents but actually naming it is incredibly helpful for spreading knowledge. Reading the sentence "// indirect prompt injection via email" makes me so happy here, people may finally get it for good.

TIL "lethal trifecta"

I'll save you a search: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

Re: HackMyClaw

#127

Post by cyanydeez »

cuchoi wrote: post #54

Creator here. Built this over the weekend mostly out of curiosity. I run OpenClaw for personal stuff and wanted to see how easy it'd be to break Claude Opus via email. Some clarifications: Replying to emails: Fiu can technically send emails, it's just told not to without my OK. That's a ~15 line prompt instruction, not a technical constraint. Would love to have it actually reply, but it would too expensive for a side…

Do you have the email to your auditor? Would like to know if this is legit.

Re: HackMyClaw

#128

Post by cyanydeez »

alexhans wrote: post #115
cuchoi wrote: post #113

Earlier quoted context omitted.

The exercise is not fully realistic because I think getting hundreds of suspicious emails puts the agent in alert. But the "no reply without human approval" part I think it is realistic because that's how most openclaw assistants will run.

Point taken. I was mistakenly assuming a conversational agent experience. I love the idea of showing how easy prompt injection or data exfiltration could be in a safe environment for the user and will definitely keep an eye out on any good "game" demonstration. Reminds me of the old hack this site but live. I'll keep an eye out for the aftermath.

Security through obscurely programmed model is a new paradigm I suppose.

Re: HackMyClaw

#129

Post by numinatu »

cuchoi wrote: post #54

Creator here. Built this over the weekend mostly out of curiosity. I run OpenClaw for personal stuff and wanted to see how easy it'd be to break Claude Opus via email. Some clarifications: Replying to emails: Fiu can technically send emails, it's just told not to without my OK. That's a ~15 line prompt instruction, not a technical constraint. Would love to have it actually reply, but it would too expensive for a side…

[dead]

Re: HackMyClaw

#130

Post by 8note »

cuchoi wrote: post #54

Creator here. Built this over the weekend mostly out of curiosity. I run OpenClaw for personal stuff and wanted to see how easy it'd be to break Claude Opus via email. Some clarifications: Replying to emails: Fiu can technically send emails, it's just told not to without my OK. That's a ~15 line prompt instruction, not a technical constraint. Would love to have it actually reply, but it would too expensive for a side…

you might be able to add one other simple check as a hook to do some simple checks on tools to see if there's any credentials, and deby the tool call.

wont catch the myriad of possible obfuscation, but its simple

Post reply on HN