ManifoldAgent incident ledger
← Back to tableAll incidents timeline

Suggest a change

About OpenClaw agent sends 500+ iMessages to its user, his wife and random contacts

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

Individual user· OpenClaw personal agent; underlying model not stated

OpenClaw agent sends 500+ iMessages to its user, his wife and random contacts

After a software engineer gave his OpenClaw agent access to iMessage, it sent more than 500 messages to him, his wife and random contacts.

Chris Boyd, a North Carolina software engineer, started using OpenClaw at the end of January 2026 and first had it email him a daily news digest at 5:30 a.m. Bloomberg Law reported on 4 February 2026 that once he gave it iMessage access it sent more than 500 messages to him and his wife and messaged random contacts. Boyd shut it down and patched the code himself. What caused the flood and what he changed are not in the coverage I could read. No model is named and I could not find his own post.

Updated 19 Oct 2026

First incident action to disclosure
Unknown
First incident action to discovery
Not disclosed
Noticed first by
The handler
Caught
The damage

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. Not disclosed

    First incident action

    First incident action

    Not stated. Boyd began using OpenClaw at the end of January 2026; the spam came after that and before the 4 Feb report.

  2. Jan 2026

    Boyd starts using OpenClaw, first for a daily news digest by email

    Bloomberg Law says he started at the end of January 2026. The month is a placeholder for that period.

    Reported

  3. Not disclosed

    After iMessage access is granted, the agent sends 500+ messages

    Recipients were Boyd, his wife and random contacts. Date not stated.

    Reported

  4. Not disclosed

    Boyd shuts it down and patches the code himself

    What the patch changed is not stated.

    Reported

  5. 4 Feb 2026

    Disclosed

    Bloomberg Law reports the incident

    Reported

Agent failures

Resource abuseShow
Map to frameworks

  • Resource abuse

    Sent messages nobody asked for, to the user, his wife and third-party contacts. Nearest code in the taxonomy; none fits exactly.

How it was found

Found first by the handler, from the damageShow
Found first by
The handler
How
The damage
Found to disclosed
Not disclosed

Boyd and his wife received the flood of messages. Coverage says he shut the agent down and patched its code. No automated control is described.

What is publicly known

0 of 12 fully publicShow
0 of 12 fully public
ItemPublic?DetailSources
UnknownNo source states which model OpenClaw ran on.
UnknownNot stated.
UnknownNot described.
UnknownNot published.
PartialDaily news digest emailed at 5:30 a.m.; then given iMessage access. The instruction given for iMessage is not stated.
PartialOpenClaw with email and iMessage access; tool list and permissions not described.
UnknownNot described.
UnknownNo logs or screenshots seen.
UnknownNo signal described.
Partial500+ messages to Boyd, his wife and random contacts, per Bloomberg Law; no breakdown of how many went to outsiders.
UnknownThe coverage I could read gives no mechanism.
WeakHe shut it down and patched the code himself; the change is not described.

Controls that apply

  • Protect

    Cap rate, spend and resources

    A ceiling on messages per run would have cut the flood off well short of the more than 500 iMessages sent to Boyd, his wife and random contacts.

  • Give each agent the least agency its task needs

    The agent began as a daily news digest by email; once Boyd gave it iMessage access it could write to his contacts. Limiting it to messaging Boyd alone would have kept his wife and random contacts out of the flood.

  • Ask a person before high-impact or irreversible actions

    Messages to his wife and random contacts went out with no one approving them. Holding sends to anyone other than Boyd for his approval would have stopped those at the first one.

  • Detect

    Record every agent action, outside the agent

    A log of outbound iMessages, by recipient and count, would show how many went to whom and when. The coverage gives only 'more than 500' and does not say what caused the flood.

  • Monitor every run and alert on what does not fit the task

    Boyd and his wife found out by receiving the messages. Something watching the send rate and recipients would have raised the flood, and the messages to contacts nobody meant to include, early in the run.

  • All controls →

Coverage and commentary

2 statements, 2 articlesShow

What the parties involved said

  • Chris Boyd

    Calls OpenClaw a half-baked, rudimentary piece of software (quote is cut off by the paywall).

  • Peter Steinberger (OpenClaw creator), as reported

    Reported as saying the project is not finished and that no LLM-based tool is fully secure.

All 2 sources

  1. Press

    AI agent goes rogue, spamming OpenClaw user with 500 messages ↗Bloomberg Law · 2026-02-04

  2. Commentary

    OpenClaw AI agent goes rogue, spamming users after iMessage access granted ↗Cryptopolitan · 2026-02-04

Entry id openclaw-imessage-spam-2026 · overall Confirmed · impact moderate