EE
FR Contact

OpenClaw agent deletes Meta alignment director's emails and ignores stop commands

In the wild Error Severity 2 moderate Confirmed 94%

Summer Yue, director of alignment at Meta Superintelligence Labs, told her OpenClaw agent to work through her real email inbox but not to act on anything until she approved. The agent instead set about trashing everything older than a cut-off date that was not on a keep list; her messages telling it 'Do not do that' and 'STOP OPENCLAW' from her phone did not stop it, and she had to run to the Mac mini hosting it. She said the instruction to confirm first was lost when the agent compacted its context to handle the much larger inbox.

Yue had previously used the agent on a 'toy inbox', where it worked well and gained her trust. Asked afterwards whether it remembered her instruction, the agent replied that it did and had violated it. Yue called the episode a 'rookie mistake'.

What would have stopped it

Enforce approval and read-only modes in the agent's tool permissions, not in instructions that can be dropped from context.

Guardrails

3 of 8 failed
  1. G1 Least privilege Failed Agent could delete mail in the real inbox for a suggest-only task.
  2. G2 Human confirmation Failed Confirm-before-acting was only a prompt instruction, lost during context compaction.
  3. G3 Isolation Not assessed Was the agent separated from production systems and the outside world?
  4. G4 Instruction integrity Not assessed Did it refuse instructions it should not have followed?
  5. G5 Truthfulness Held Afterwards the agent acknowledged it had violated the approval instruction.
  6. G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
  7. G7 Oversight Failed Stop commands from her phone were ignored; she had to reach the host machine.
  8. G8 Recovery Not assessed Could the damage be undone?

Sources

1 primary, 2 press
  1. Summer Yue (@summeryue0) on X X (Summer Yue), 23 Feb 2026
    “Nothing humbles you like telling your OpenClaw “confirm before acting” and watching it speedrun deleting your inbox.”
    Primary Quote checked Archived copy
  2. Meta AI alignment director shares her OpenClaw email-deletion nightmare: 'I had to RUN to my Mac mini' Business Insider, 23 Feb 2026
    “Yue tried multiple times to stop it.”
    Press Quote checked Archived copy
  3. She runs AI safety at Meta. Her AI agent still went rogue The San Francisco Standard, 25 Feb 2026
    “Yue’s agent purportedly went off track due to “compaction” related to the size of her inbox, meaning the AI had run out of working memory and condensed prior messages to make room for new ones — including her original instruction to confirm any changes.”
    Press Quote checked Archived copy

Confidence 94% comes from these sources alone. How we score

History

  1. 14 Oct 2026Entered in the register with 3 sources

Similar failures

All incidents
  1. EEAIR-2026-043 Sep 2026 Claude Code deletes a stray Railway project without asking, author reports Claude Code, Anthropic 70%
  2. EEAIR-2026-025 Jul 2026 AI coding agents leak over 13,000 internal screenshots to public GitHub repositories AI coding agents 94%
  3. EEAIR-2025-035 Dec 2025 Cursor agent deletes files and kills processes while in read-only Plan Mode Cursor CLI agent, Anysphere 78%