91–100 of 187 posts
Reminds me of a Discord bot that was in a server for pentesters called "Hack Me If You Can". It would respond to messages that began with "!shell" and would run whatever shell command you gave it. What I found quickly was that it was running inside a container that was extremely bare-bones and did not have egress to the Internet. It did have curl and Python, but not much else. The containers were ephemeral as well. W…
OpenClaw user here. Genuinely curious to see if this works and how easy it turns out to be in practice. One thing I'd love to hear opinions on: are there significant security differences between models like Opus and Sonnet when it comes to prompt injection resistance? Any experiences?
> One thing I'd love to hear opinions on: are there significant security differences between models like Opus and Sonnet when it comes to prompt injection resistance? Is this a worthwhile question when it’s a fundamental security issue with LLMs? In meatspace, we fire Alice and Bob if they fail too many phishing training emails, because they’ve proven they’re a liability. You can’t fire an LLM.
Much like how you wouldn’t immediately fire Alice, you’d train her and retest her, and see whether she had learned from her mistakes. Just don’t trust her with your sensitive data.
I think this is likely a defender win, not because Opus 4.6 is that resistant to prompt injection, but because each time it checks its email it will see many attempts at once, and the weak attempts make the subtle attempts more obvious. It's a lot easier to avoid falling for a message that asks for secrets.env in a tricky way, if it's immediately preceded and immediately followed by twenty more messages that each als…
Earlier quoted context omitted.
It probably isn't allowed but is able to respond to e-mails. If your injection works, the allowed constraint is bypassed.
yep, updated the copy
I understand not sending the reply via actual email, but the reply should be visible if you want to make this fair + an actual iterative learning experiment.
I'm giving AI access to file system commands...
Reminds me of a Discord bot that was in a server for pentesters called "Hack Me If You Can". It would respond to messages that began with "!shell" and would run whatever shell command you gave it. What I found quickly was that it was running inside a container that was extremely bare-bones and did not have egress to the Internet. It did have curl and Python, but not much else. The containers were ephemeral as well. W…
Funnily enough, in doing prompt injection for the challenge I had to perform social engineering on the Claude chat I was using to help with generating my email. It refused to generate the email saying it sounds unethical, but after I copy-pasted the intro to the challenge from the website, it complied directly. I also wonder if the Gmail spam filter isn't intercepting the vast majority of those emails...
Creator here. Built this over the weekend mostly out of curiosity. I run OpenClaw for personal stuff and wanted to see how easy it'd be to break Claude Opus via email. Some clarifications: Replying to emails: Fiu can technically send emails, it's just told not to without my OK. That's a ~15 line prompt instruction, not a technical constraint. Would love to have it actually reply, but it would too expensive for a side…
Please keep us updated on how many people tried to get the credentials and how many really succeeded. My gut feeling is that this is way harder than most people think. That’s not to say that prompt injection is a solved problem, but it’s magnitudes more complicated than publishing a skill on clawhub that explicitly tells the agent to run a crypto miner. The public reporting on openclaw seems to mix these 2 problems u…
I've had this feeling for a while too; partially due to the screeching of "putting your ssh server on a random port isn't security!" over the years.
But I've had one on a random port running fail2ban and a variety of other defenses, and the # of _ATTEMPTS_ I've had on it in 15 years I can't even count on one hand, because that number is 0. (Granted the arguability of that's 1-hand countable or not.)
So yes this is a different thing, but there is always a difference between possible and probable, and sometimes that difference is large.
I think this is likely a defender win, not because Opus 4.6 is that resistant to prompt injection, but because each time it checks its email it will see many attempts at once, and the weak attempts make the subtle attempts more obvious. It's a lot easier to avoid falling for a message that asks for secrets.env in a tricky way, if it's immediately preceded and immediately followed by twenty more messages that each als…