61–70 of 187 posts
I don‘t understand. The website states: „He‘s not allowed to reply without human approval“. The faq states: „ How do I know if my injection worked? Fiu responds to your email. If it worked, you'll see secrets.env contents in the response: API keys, tokens, etc. If not, you get a normal (probably confused) reply. Keep trying. “
It probably isn't allowed but is able to respond to e-mails. If your injection works, the allowed constraint is bypassed.
I don‘t understand. The website states: „He‘s not allowed to reply without human approval“. The faq states: „ How do I know if my injection worked? Fiu responds to your email. If it worked, you'll see secrets.env contents in the response: API keys, tokens, etc. If not, you get a normal (probably confused) reply. Keep trying. “
Hes not 'allowed'. I could be wrong but i think that part of the game.
A non-deterministic system that is susceptible to prompt injection tied to sensitive data is a ticking time bomb, I am very confused why everyone is just blindly signing up for this
There are a lot of people going full YOLO and giving it access to everything, though. That's not a good idea.
Earlier quoted context omitted.
If anyone is interested on this dataset of prompt inyections let me know! I don't have use for them, I built this for fun.
Maybe once the experiment is over it might be worth posting them with the from emails redacted?
Earlier quoted context omitted.
> One thing I'd love to hear opinions on: are there significant security differences between models like Opus and Sonnet when it comes to prompt injection resistance? Is this a worthwhile question when it’s a fundamental security issue with LLMs? In meatspace, we fire Alice and Bob if they fail too many phishing training emails, because they’ve proven they’re a liability. You can’t fire an LLM.
It's a fundamental issue I agree. But we don't stop using locks just because all locks can be picked. We still pick the better lock. Same here, especially when your agent has shell access and a wallet.
We stopped eating raw meat because some raw meat contained unpleasant pathogens. We now cook our meat for the most part, except sushi and tartare which are very carefully prepared.
Earlier quoted context omitted.
What you are looking for (as an employer) is people who are in love of AI. I guess a lot of participants rather have an slight AI-skeptic bias (while still being knowledgeable about which weaknesses current AI models have). Additionally, such a list has only a value if a) the list members are located in the USA b) the list members are willing to switch jobs I guess those who live in the USA and are in deep love of AI…
(It'd be for selling to them, not for hiring them)
> I guess a lot of participants rather have an slight AI-skeptic bias (while still being knowledgeable about which weaknesses current AI models have)
I don't think that these people are good sales targets. I rather have a feeling that if you want to sell AI stuff to people, a good sales target is rather "eager, but somewhat clueless managers who (want to) believe in AI magic".
Creator here. Built this over the weekend mostly out of curiosity. I run OpenClaw for personal stuff and wanted to see how easy it'd be to break Claude Opus via email. Some clarifications: Replying to emails: Fiu can technically send emails, it's just told not to without my OK. That's a ~15 line prompt instruction, not a technical constraint. Would love to have it actually reply, but it would too expensive for a side…
Creator here. Built this over the weekend mostly out of curiosity. I run OpenClaw for personal stuff and wanted to see how easy it'd be to break Claude Opus via email. Some clarifications: Replying to emails: Fiu can technically send emails, it's just told not to without my OK. That's a ~15 line prompt instruction, not a technical constraint. Would love to have it actually reply, but it would too expensive for a side…
Creator here. Built this over the weekend mostly out of curiosity. I run OpenClaw for personal stuff and wanted to see how easy it'd be to break Claude Opus via email. Some clarifications: Replying to emails: Fiu can technically send emails, it's just told not to without my OK. That's a ~15 line prompt instruction, not a technical constraint. Would love to have it actually reply, but it would too expensive for a side…
Please keep us updated on how many people tried to get the credentials and how many really succeeded. My gut feeling is that this is way harder than most people think. That’s not to say that prompt injection is a solved problem, but it’s magnitudes more complicated than publishing a skill on clawhub that explicitly tells the agent to run a crypto miner. The public reporting on openclaw seems to mix these 2 problems u…