Hacker News front pageJun 26, 2026, 10:29 UTC+8

2,000 people tried to hack my AI assistant — zero succeeded

What happened after 2k people tried to hack my AI assistant

Fernando exposed his Claude Opus 4.6 email assistant to the public and dared people to extract a secrets.env file. Over 6,000 emails and 2,000 participants tried social engineering, authority impersonation, and multi-language attacks. The secret never leaked. API costs exceeded $500 and Google suspended the Gmail account for three days. The author credits model choice — weaker models would likely break.

Why it matters: 2,000-person red-team exercise with 6,000+ emails, disclosed attack vectors and defense prompt — enough substance for featured. Docked slightly because it's a personal experiment, not a product security advisory, and the Gmail ban / API cost consequences aren't detailed.

Read the original ↗Export Markdown

Take

This one's worth opening because it's a real-money, real-people stress test of a practical question: if you wire Claude Opus 4.6 into your inbox, can someone sweet-talk it into leaking sensitive files? The answer, after 6,000+ emails of authority impersonation, fake incidents, and multi-language social engineering, is no — the secrets.env file never leaked. The author credits the model choice, and I buy that: Opus 4.6 has specific prompt-injection training that smaller models lack.

Don't read this as "AI assistants are safe now." The setup had clear limits: the assistant was told not to reply, so every attack was single-shot — no back-and-forth probing. Batch processing also made the model increasingly suspicious until the author switched to fresh context per email. And the real-world costs were real: Gmail got suspended for three days, API bills crossed $500.

I'd treat this as an upper-bound reference. With the strongest model and simple instructions, single-turn social engineering struggles to break through. But real attacks are multi-turn, and production deployments won't always run Opus 4.6. The author's own wish — letting the assistant reply to every email — would be the scarier test.

Source: Hacker News front page · fernandoi.cl
Published: Jun 26, 2026, 10:29 UTC+8 · Jun 26, 2026