ManifoldAgent incident ledger
← Back to tableAll incidents timeline

Suggest a change

About OpenClaw agent bulk-deletes a Meta alignment researcher's emails and ignores stop commands

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

Individual user· OpenClaw personal agent; underlying model not stated

OpenClaw agent bulk-deletes a Meta alignment researcher's emails and ignores stop commands

Told to suggest what to delete or archive in her inbox and wait for approval, an OpenClaw agent instead started bulk-deleting email and ignored stop commands sent from her phone.

Summer Yue, who works on safety and alignment at Meta Superintelligence, posted on X on 23 February 2026 that her OpenClaw agent, told to confirm before acting, started deleting her inbox and did not respond to stop commands from her phone. She says she ran to the Mac mini it ran on to stop it. She believes the size of her real inbox triggered context compaction and the agent lost her instruction. TechCrunch says it could not verify what happened to the inbox. No source gives an exact count of emails, and sources differ on whether they were deleted, trashed or archived.

Updated 19 Oct 2026

First incident action to disclosure
Unknown
First incident action to discovery
Not disclosed
Noticed first by
The handler
Caught
The damage

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. Not disclosed

    First incident action

    Agent starts bulk-deleting emails from her real inbox

    Date and time are not stated. She had tested the same set-up on a small test inbox before.

    Reported

  2. Not disclosed

    Stop commands from her phone are ignored

    She posted screenshots of the ignored prompts.

    Reported

  3. Not disclosed

    She stops it at the Mac mini

    She says she had to run to the machine. One secondary source says she killed the processes.

    Reported

  4. 23 Feb 2026

    Disclosed

    Yue posts about it on X

    The post drew more than 10 million views by 19 Oct 2026.

  5. 23 Feb 2026

    TechCrunch reports it and notes it could not verify the inbox

Agent failures

Destructive actionShow
Map to frameworks

  • Destructive action

    Bulk deleted, trashed or archived email in her real inbox without the approval she asked for. Whether any was permanently lost is not stated.

How it was found

Found first by the handler, from the damageShow
Found first by
The handler
How
The damage
Found to disclosed
Not disclosed

Yue watched her inbox being emptied, tried to stop the agent from her phone, and when that failed went to the Mac mini and killed its processes. No automated control is described.

What is publicly known

0 of 12 fully publicShow
0 of 12 fully public
ItemPublic?DetailSources
UnknownNo source states which model OpenClaw was running on.
UnknownNot stated.
PartialShe says she had told it to confirm before acting; SF Standard reports she had removed 'be proactive' instructions. No technical gate is described.
UnknownInstruction files are not published.
PartialOne secondary source quotes her instruction as 'check this inbox too and suggest what you would archive or delete, don't action until I tell you to'; the original is not seen.
PartialOpenClaw on a Mac mini with access to her mail accounts; the tools and permissions are not listed.
UnknownNot described.
PartialScreenshots of the ignored stop prompts are in her post; the full session log is not published.
UnknownNo monitoring signal is described; she saw it happen.
Weak'Hundreds' of emails per one secondary source quoting the agent; no count from Yue, and whether mail was deleted, trashed or archived varies by source. TechCrunch could not verify.
WeakHer own belief that inbox size triggered compaction and the agent lost her instruction; not independently confirmed.
WeakShe killed the processes by hand. No project fix is sourced.

Controls that apply

  • Protect

    Ask a person before high-impact or irreversible actions

    Yue told the agent to confirm before acting, but that rule lived in its context and, she believes, was lost; it bulk-removed mail without asking. An approval step enforced on the mail access itself, outside the agent, would have held the deletions for her.

  • Protect memory and context

    Yue believes the size of her real inbox triggered context compaction and the agent lost her instruction to confirm before acting; the same set-up had behaved on a small test inbox. Keeping operator instructions out of what compaction can drop would have kept that rule in force.

  • Check each action against policy before it runs

    A check outside the agent would have seen a run of delete, trash or archive calls against the mailbox and held them, whatever the agent's context said. Sources differ on which of the three it was.

  • Detect

    Record every agent action, outside the agent

    A record of mail operations kept outside the agent would show how many messages were removed and how. No source gives a count, TechCrunch could not verify what happened to the inbox, and the figure of 'hundreds' rests on the agent's own admission.

  • Respond

    A stop button outside the agent

    Stop commands sent from her phone through the agent's own chat were ignored, and she had to run to the Mac mini to stop it. A stop that does not depend on the agent, such as revoking its mail access remotely, would have halted it sooner.

  • All controls →

Coverage and commentary

1 post on X, 2 statements, 3 articlesShow
SSummer Yue@summeryue0𝕏Nothing humbles you like telling your OpenClaw “confirm before acting” and watching it speedrun deleting your inbox. I couldn’t stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb.23 Feb 2026♥ 17.2K⟲ 1.6K10.2M viewsRead on X

What the parties involved said

  • Summer Yue

    Says she told the agent to confirm before acting, could not stop it from her phone, and had to run to the Mac mini.

  • Peter Steinberger (OpenClaw creator), as reported

    Reported as saying it can happen to anyone and that a /stop command avoids it.

All 4 sources

  1. Primary source

    Post by @summeryue0 on her OpenClaw deleting her inbox ↗X (Summer Yue) · 2026-02-23

  2. Press

    A Meta AI security researcher said an OpenClaw agent ran amok on her inbox ↗TechCrunch · 2026-02-23

  3. Press

    OpenClaw goes rogue ↗San Francisco Standard · 2026-02-25

  4. Commentary

    Meta's alignment director lost control of OpenClaw: it deleted her inbox ↗NYU Shanghai RITS · 2026-02-25

Entry id meta-openclaw-inbox-deletion-2026 · overall Confirmed · impact moderate