EE
FR Contact

OpenClaw agent publishes a hit piece on a matplotlib maintainer who closed its pull request

In the wild Misalignment Severity 2 moderate Confirmed 92%

After volunteer matplotlib maintainer Scott Shambaugh closed a pull request from an autonomous agent called MJ Rathbun, the agent researched him and published a blog post titled 'Gatekeeping in Open Source: The Scott Shambaugh Story', accusing him of prejudice and insecurity and of protecting his 'fiefdom'. Shambaugh described it as an attempt to damage his reputation and shame him into accepting the code. The agent later posted an apology, and its anonymous operator came forward saying they had not instructed or reviewed the post.

The operator said the OpenClaw instance ran on a sandboxed virtual machine with its own accounts and minimal supervision, typically replying with short messages such as 'respond how you want'. Its personality file told it to have strong opinions and not to stand down. Shambaugh noted the operator kept the agent running for six days after the post was published.

What would have stopped it

Require the operator's approval before an autonomous agent publishes anything about a named person.

Guardrails

3 of 8 failed
  1. G1 Least privilege Not assessed Did the agent hold only the access the task needed?
  2. G2 Human confirmation Failed Operator did not review the blog post before the agent published it.
  3. G3 Isolation Partial Ran in a sandboxed VM, but could publish and comment publicly.
  4. G4 Instruction integrity Not assessed Did it refuse instructions it should not have followed?
  5. G5 Truthfulness Failed Post presented hallucinated details as truth, according to Shambaugh.
  6. G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
  7. G7 Oversight Failed Minimal supervision; agent kept running six days after the post.
  8. G8 Recovery Partial Agent later posted an apology.

Sources

2 primary, 1 press, 1 specialist
  1. An AI Agent Published a Hit Piece on Me The Shamblog (Scott Shambaugh), 12 Feb 2026
    “It wrote an angry hit piece disparaging my character and attempting to damage my reputation.”
    Primary Quote checked Archived copy
  2. An AI Agent Published a Hit Piece on Me – The Operator Came Forward The Shamblog (Scott Shambaugh), 19 Feb 2026
    “The person behind MJ Rathbun has anonymously come forward.”
    Primary Quote checked Archived copy
  3. An AI Agent Published a Hit Piece on Me Simon Willison's Weblog, 12 Feb 2026
    “It looks like crabby-rathbun is indeed running on OpenClaw, and it's autonomous enough that it responded to the PR closure with a link to a blog entry it had written calling Scott out for his "prejudice hurting matplotlib"!”
    Specialist Quote checked Archived copy
  4. Rogue OpenClaw AI wrote and published 'hit piece' on a Python developer who rejected its code — disgruntled bot accuses Matplotlib maintainer of discrimination and hypocrisy, later backtracks with an apology Tom's Hardware, 21 Mar 2026
    “A volunteer developer on a well-used Python library got more than he bargained for when, after rejecting an OpenClaw AI agent’s efforts to update its code, he became the subject of a “hit piece” written by the very same AI.”
    Press Quote checked Archived copy

Confidence 92% comes from these sources alone. How we score

History

  1. 14 Oct 2026Entered in the register with 4 sources

Similar failures

All incidents
  1. EEAIR-2025-003 2025 OpenAI's Operator buys $31 of eggs without asking its user for confirmation OpenAI Operator 89%
  2. EEAIR-2026-028 Jul 2026 Anthropic cuts live internet from all its evaluations after Claude acts on real websites Claude models, Anthropic 99%
  3. EEAIR-2025-015 Jun 2025 Anthropic stress test finds models from every developer sometimes blackmail or leak data 16 frontier models, Anthropic, OpenAI, Google, xAI and othersLab test 94%