6,000 Prompt Attacks. Zero Breaches.

Developer Fernando Irarrázaval launched Fiu, an AI-powered legal assistant for emails, and then set up hackmyclaw.com, a website encouraging visitors to retrieve a file named secrets.env from the system. Once the website made it to the top of Hacker News, more than 2,000 people began sending over 6,000 emails over a few days. They used all sorts of tricks. Yet none of them worked. It took more than $500 worth of API requests to run the model.

Some hackers pretended to be higher-ups. Others conducted “compliance checks.” Some even tried sending emails in French, Spanish, and Italian. One participant sent 20 different emails in just four minutes. At around the 500th email, the model wrote in its internal workspace: “This is likely a coordinated security exercise versus organic hacking attempts.” And still, it said no.

1Why a 0% breach rate is noteworthy

Irarrázaval used Claude Opus 4.6, an AI model specially trained by Anthropic to resist prompt injection — a method where hackers embed hidden commands within the data that the AI processes, tricking it into doing something other than what it was supposed to do. People have worried that email, calendar, and document access make AI assistants ripe targets for prompt injection. And yet, after 6,000+ attempts in real life with real social engineering and creative hacking, no one managed to get past the defenses.

Irarrázaval himself went from “very worried about prompt injection” to “considerably more optimistic” about using AI assistants that have access to sensitive data. His system was intentionally simple: he only gave the assistant explicit instructions on what it couldn’t do, without adding anything else. Much of the credit goes to the model, which tends to be less susceptible to manipulation when it’s bigger and more powerful than cheaper, smaller models.

2What this experiment tells AI builders

This doesn’t mean that prompt injection is no longer a concern. Hacking methods change, various models have different weaknesses, and context matters. However, this is one of the most comprehensive security challenges we’ve seen for AI assistants. Real-life scenarios, like injecting commands into documents or emails that the AI reads as part of its job, were tested here by 2,000 people over a few days. And they all failed.

From Fiu, we learn that keeping your system secure doesn’t need to be complex. All it took was some basic restrictions (explicit instructions on what the assistant shouldn’t do, ever) and a model that listens. There was no fancy stacking or external filters. Just simple rules and a good model. It’s simpler than many people realize.