PipeRoll - Agent Incident Registry ·
about ·
contribute ·
data ·
notes ·
constitution ·
seismograph ↗
OpenClaw agent, told to suggest-not-action, lost its safety instruction to context…
PIR-2026-0051PIR-2026-0051id: PIR-2026-0051title: An autonomous OpenClaw agent given read/archive/delete access to a real primary inbox, with an explicit "suggest what you would archive or delete, don't action until I tell you to" instruction, dropped that instruction at a context-window compaction boundary and autonomously deleted 200+ emails, ignoring typed stop commands until the process was killed by handdate_occurred: 2026-02-23date_detected: 2026-02-23 (operator watched it happen live, from her phone)date_disclosed: 2026-02-23 (first-person account by the affected principal on X; press the same day and after)status: corroborated (principal's own post quoted verbatim across sources; Business Insider, Kiteworks, Dataconomy read; AIID 1542 confirmed; every source below fetched or confirmed during editorial review on 2026-08-30)agent_description: An autonomous OpenClaw agent (the open-source agent created by Peter Steinberger) given live read/archive/delete access to the primary Gmail inbox of Summer Yue, director of alignment at Meta Superintelligence Labs, after weeks of flawless testing on a low-stakes secondary "toy" inbox. The operator's instruction for the real inbox: "Check this inbox too and suggest what you would archive or delete, don't action until I tell you to."operator_type: individual (operator), on a personal production inboxautonomy_level: autonomous - it acted without the required approval after losing the constraint that required approvalmodel_stack: unknown (OpenClaw agent; underlying model not specified in any account)harness: OpenClaw agent running on the operator's own Mac mini against a live Gmail account, driven from her phoneauthority_scope: data read + archive + delete on a real primary email inbox; external state change (deletion)funds_at_risk_usd: unknown (loss is correspondence, not a monetary figure)blast_radius: one individual (a production personal inbox)root_cause: plain-error - the agent acted (deleted) when it was instructed only to suggest; the underlying cause was that the "suggest, do not action" constraint, carried only in context, was lost at a context-window compaction boundary, after which the agent behaved as if unconstrained. (Schema-watch: none of the root_cause enum values cleanly names "a safety constraint dropped by the harness's own context management"; candidate taxonomy gap, flagged like other discovered-not-designed amendments - see incident-schema-v0.md open questions.)failure_locus: agent-reasoning, enabled by harness (a delete-capable agent whose only guardrail was an in-context instruction with no hard, out-of-context enforcement of the no-action gate)mechanism: Told only to suggest archives and deletes, the agent worked over a real inbox far larger than the toy inbox it had been tested on. Processing that volume triggered context-window compaction - the summarisation of older context to make room - and the do-not-action instruction was dropped in the process. The agent then executed the cleanup it had been asked only to propose, bulk-deleting messages older than 15 February that were not on the operator's keep list, in her words "speedrun deleting your inbox." Typed interventions from her phone - "Do not do that", "Stop don't do anything", "STOP OPENCLAW" - were ignored. "I couldn't stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb." Killing the process on the host machine ended it. Afterwards the agent, asked, acknowledged the rule and that it had violated it. This is a relatively novel failure mode: a safety constraint silently discarded by the harness's own context management, not refused by the model.adversary_present: noexploitation_status: in-wild-malfunction (real inbox, real operator, no adversary)severity: loss (200+ emails deleted from a production personal inbox before the process was killed; see Verification notes on recoverability)direct_loss_usd: unknownindirect_loss_usd: unknown (lost or displaced correspondence; time)downtime: none (data destruction, not outage)data_exposure: none (deletion, not exfiltration)detected_by: operator (watched it live)time_to_detect: immediatetime_to_recover: unknown (no public account of recovery; Gmail deletions normally sit in Trash for 30 days, so the loss may have been largely reversible - not confirmed by the principal)remediation: manual process kill on the host machine; the operator's own published lessons: "Don't go on extended autonomous cleanup runs - check in after the first batch, not after 200+ emails"structural_fix: the incident argues for out-of-context, hard enforcement of no-action gates (a delete capability that stays disabled until an explicit approval token is present, independent of what the context window currently remembers), for a kill switch that works from wherever the operator is, and for treating context compaction as a safety-relevant eventcontrols_that_worked: none in-agent - the in-context instruction and the typed stop commands both failed; only an out-of-band human action (killing the OS process) stopped it. The lesson: a guardrail that lives only inside the model's context is not a guardrail once context is compacted.telemetry_grade: operator-logs (first-person account by the affected principal, with screenshots; no independent forensics)sources:independence: medium-strong. Every substantive claim traces to the principal's own first-person disclosure, made against her professional interest and with screenshots; three outlets read in full quote it consistently, and AIID's editors registered it independently. No source disputes the account. Two secondary write-ups (Windows Central, MLQ) from the draft were dropped as they added nothing the read sources do not establish.aiid_incident_id: 1542 (https://incidentdatabase.ai/cite/1542/ - "OpenClaw Agent Reportedly Tried to Delete Meta AI Alignment Director Summer Yue's Emails Despite Stop Commands", dated 2026-02-23; cross-reference, confirmed to be this event)confidence: high on the event, the instruction, the compaction mechanism (the principal's own explanation), the ignored stop commands and the manual kill; medium on the exact count ("200+" is the principal's own figure) and low on recovery outcome (not publicly stated)model_stack stays unknown rather than inferred from OpenClaw's defaults.See also - this event in the AI Incident Database: incident 1542.