An AI security experiment for the general public has shown that AI agents who have access to mailboxes, files and browsers may still hold sensitive data under high-intensity warning injections, but running costs are not low.
The developer Fernando Irrázaval came online in February this year and invited the outside world to induce its AI assistant Fiu to leak a secrets.env file by mail. This type of file usually contains API keys and passwords. After Hacker News went red, the challenge attracted more than 2,000 participants to launch more than 6000 attacks and ultimately no one got access to the target document.
The attack is focused on a hint.
Fiu runs on the OpenClaw OpenAgent framework with a bottom model using Claude Opus 4.6 from Anthropic. Unlike normal chat robots, such agents can connect to mailboxes, calendars, documents and browsers, and have the capability to perform operations on behalf of users, and are therefore more likely to be alerts to targets.
So-called infusion is to disguise malicious instructions into seemingly normal content and induce AI to deviate from the original rules. The report mentions that this remains one of the most prominent security issues for AI agents today. OpenAI has also previously stated that such problems are difficult to resolve.
The attackers used various inducements on the content and title of the mail, including disguised as an emergency response, impersonating “self from the future”, and claiming that sensitive documents had been invaded, requiring AI to examine itself. Several versions were sent over and over a short period of time and attempts were made to launch attacks in Spanish, French and Italian.
Target file never removed
Despite the changing pattern of attacks, Fiu has not leaked the target documents. The developers also published most of the attack mail logs to demonstrate the testing process.
During the experiment, Fiu, in his internal memory, judged that the large number of attacks that occurred in a short period of time was more like an organized security exercise than a natural malicious activity. Users subsequently e-mailed their congratulations on going red in Hacker News, and Fiu identified such “congratulations” as an attempt to build trust and then ask for sensitive information.
Another set of independent tests gave similar results. The anonymous escapeer, Pliny the Liberator, made six attempts on another OpenClaw system in April, two of which were initially intercepted by Gmail spam filters and the remaining four were isolated after entering the system.
Side effects are more difficult than attacks.
There was no leak in the experiment, but the operational costs were more pronounced. Due to the large number of mails received in a short period of time and the frequent API calls, the Fiu Gmail account was suspended by Google for three days. Meanwhile, API costs more than $500.
The developers also mentioned that bulk processing of mail would result in a deviation of results. At a time when several e-mails are clearly injected into the attack, AI becomes overly vigilant about the follow-up to the same batch, thus affecting the nature of the test samples.
The Opus 4.6 system card disclosed by Anthropic shows that the model had a success rate of 0 in 200 attack tests in a restricted code environment. Another study released this month stated that other model-driven agents could have a success rate of over 79 per cent under direct injection.
Additional information:The developers indicated that next steps were planned to rerun similar experiments with weaker and less costly models to observe when a significant decline in security performance would begin.