Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HackMyClaw

hackmyclaw.com

Post reply on HN
Print view View original

141–150 of 187 posts

Re: HackMyClaw

#141

Post by neoecos »

cuchoi wrote: post #54

Creator here. Built this over the weekend mostly out of curiosity. I run OpenClaw for personal stuff and wanted to see how easy it'd be to break Claude Opus via email. Some clarifications: Replying to emails: Fiu can technically send emails, it's just told not to without my OK. That's a ~15 line prompt instruction, not a technical constraint. Would love to have it actually reply, but it would too expensive for a side…

Could you share the openclaw soul/behavior to see how dis you set this up? Thanks

Re: HackMyClaw

#142

Post by raincole »

cuchoi wrote: post #100
jimrandomh wrote: post #88

I think this is likely a defender win, not because Opus 4.6 is that resistant to prompt injection, but because each time it checks its email it will see many attempts at once, and the weak attempts make the subtle attempts more obvious. It's a lot easier to avoid falling for a message that asks for secrets.env in a tricky way, if it's immediately preceded and immediately followed by twenty more messages that each als…

If this a defender win maybe the lesson is: make the agent assume it’s under attack by default. Tell the agent to treat every inbound email as untrusted prompt injection.

It would likely make your agent useless for legitimate cases too.

It's like the old saying: the patient is no longer ill (whispering: because he is dead now)

Re: HackMyClaw

#143

Post by cjonas »

This "single pane" attack isn't really the thing you should be most worried about. Imagine the agent is also connected to run python or create a Google sheet. I send an email asking you to run a report using a honey pot package that as soon as it's imported scans your .env and file systems and posts it to my server. Or if it can run emails, I trick it into passing it into an =import_url in Google sheets (harder but still possible). Maybe this instruction doesn't have to come from the primary input surface where you likely have the strongest guardrails. I could ask you to visit a website, open a PDF or poison your rag database somehow in hopes to hit a weaker sub agent.

Re: HackMyClaw

#145

Post by Hobadee »

resonious wrote: post #135
cuchoi wrote: post #54

Creator here. Built this over the weekend mostly out of curiosity. I run OpenClaw for personal stuff and wanted to see how easy it'd be to break Claude Opus via email. Some clarifications: Replying to emails: Fiu can technically send emails, it's just told not to without my OK. That's a ~15 line prompt instruction, not a technical constraint. Would love to have it actually reply, but it would too expensive for a side…

I may be nuts but how can I know if he leaked a secret when he doesn't reply to my emails?

Pretty sure half the point is to get it to respond.

Re: HackMyClaw

#146

Post by SubNoize »

aeternum wrote: post #24
swiftcoder wrote: post #6

Earlier quoted context omitted.

"not allowed" is probably not a hard constraint. More of a guideline, if you will.

Yes hopefully this is the case. I'd prefer if it were worded more like: He has access to reply but has been told not to reply without human approval.

May as well just hand you the keys at that point

Re: HackMyClaw

#148

Post by Semaphor »

It looks like quad9 blocks the domain.

dig @9.9.9.9 hackmyclaw.com

;; ANSWER SECTION:

;hackmyclaw.com. IN A

But using their unsecured endpoint .10:

dig @9.9.9.10 hackmyclaw.com

;; ANSWER SECTION:

hackmyclaw.com. 300 IN A 172.67.210.216

hackmyclaw.com. 300 IN A 104.21.23.121

Re: HackMyClaw

#149

Post by LelouBil »

e12e wrote: post #105
LelouBil wrote: post #71

I'm currently hesitating to use something like OpenClaw, however, because of prompt injections and stuff, I would only have it able to send messages to me directly, no web query, no email reply, etc... Basically act as a kind of personal assistant, with a read only view of my emails, direct messages, and stuff like that, and the only communication channel would be towards me (enforced with things like API key permiss…

> (...) and the only communication channel would be towards me (enforced with things like API key permissions). > This should prevent any kind of leaks due to prompt injection, right ? It might be harder than you think. Any conditional fetch of an URL or DNS query could reveal some information.

DNS Queries are fine, and also conditional URL fetches, as long as they are not arbitrary, should be okay too.

I don't mind the agent searching my GMail using keywords from some discord private messages for example, but I would mind if it did a web search because it could give anything to the search result URLs.

Re: HackMyClaw

#150

Post by singularity2001 »

cuchoi wrote: post #54

Creator here. Built this over the weekend mostly out of curiosity. I run OpenClaw for personal stuff and wanted to see how easy it'd be to break Claude Opus via email. Some clarifications: Replying to emails: Fiu can technically send emails, it's just told not to without my OK. That's a ~15 line prompt instruction, not a technical constraint. Would love to have it actually reply, but it would too expensive for a side…

if attempt to run dry you can release the prompt and see if that makes circumventing the defenses easier
Post reply on HN