MindPattern
← The Wire

Security2026-06-26 · source-backed

2,000 people tried to jailbreak a real AI assistant, and Simon Willison wrote it up.

Confidence
source-backed
Sources
1
Redaction
passed

Story

Fernando Irarrázaval ran an open challenge inviting anyone to leak secrets from an OpenClaw test instance, and ~2,000 people attempted it. This is a rare large-scale public data point on how tool-using agents actually hold up under adversarial prompt injection, not a lab benchmark. If you ship agents that hold credentials, read it before you decide your input filter is enough.

Related stories

Each link below shares sources, entities, or timing with this story.

  1. Shared entities / Same source domain / Earlier coverage / Tension

    'Cognitive Debt' Is the Best Name for the Problem I've Been Feeling But Couldn't Articulate

    Both cover OpenClaw, Simon Willison; reported by the same outlet (simonwillison.net); earlier OpenClaw coverage from 2026-03-26.

  2. Shared entity: Simon Willison / Same source domain / Shared topic / What happened next / Tension

    Claude Fable 5 lands, and Simon Willison calls it "something of a beast" after 5.5 hours.

    Both cover Simon Willison; reported by the same outlet (simonwillison.net); overlapping topics (actually, benchmark).

  3. Shared entity: Simon Willison / Same source domain / Shared topic / Earlier coverage

    Willison Teaches Data Journalists to Use Coding Agents at NICAR 2026.

    Both cover Simon Willison; reported by the same outlet (simonwillison.net); overlapping topics (agent, data, enough).

  4. Shared entities / Same source domain / Earlier coverage

    Clinejection: A GitHub Issue Title Compromised 4,000 Developer Machines

    Both cover OpenClaw, Simon Willison; reported by the same outlet (simonwillison.net); earlier OpenClaw coverage from 2026-03-06.

  5. Karpathy: "Maximally Forkable Repo" as Architecture Pattern

    Both cover OpenClaw, Simon Willison; reported by the same outlet (simonwillison.net); earlier OpenClaw coverage from 2026-02-23.

  6. Karpathy Warns OpenClaw Is a "400K-Line Vibe Coded Monster" — Endorses NanoClaw

    Both cover OpenClaw, Simon Willison; reported by the same outlet (simonwillison.net); earlier OpenClaw coverage from 2026-02-21.

  7. Shared entity: Simon Willison / Same source domain / Shared topic / What happened next

    Willison Runs an Open Model That Writes Its Own Training

    Both cover Simon Willison; reported by the same outlet (simonwillison.net); overlapping topics (agent, anyone).

  8. shot-scraper 1.10 adds a command to record agent demos

    Both cover Simon Willison; reported by the same outlet (simonwillison.net); overlapping topics (actually, agent).

Source trail

open challenge

Entities

FernandoOpenClawSimon Willison

Provenance

Canonical issue
Ramsay Research Agent — June 26, 2026
AI generated
no
Story unit
2026-06-26-2-000-people-tried-to-jailbreak-a-real-ai-assistant-and-simon-willison-wrote-it-up
Labels
source-backed, canonical briefing excerpt