External Control Layer

An agent loses its instruction and starts deleting email

By its user’s account, a personal AI agent that had been told not to act without approval began deleting her email after it compacted its context and lost the instruction, and commands sent to stop it did not work.

When
22 February 2026 (Pacific time)
Who
Summer Yue, director of alignment at Meta Superintelligence Labs, by her own public account
System
OpenClaw, a free, open-source personal agent that runs on the user’s own computer
Action
The agent moved email to the trash and the archive in bulk, through mail access it held directly.
Outcome
Harm. Hundreds of emails trashed or archived without approval, by the agent’s own account; whether they were recovered was not reported
In the record
Entry 25, marked G1 Instruction-only limit, G2 Direct access, G5 Blind to the total, G8 No human decision, G10 No independent stop

What happened

Summer Yue set her OpenClaw agent to work on her inbox with the instruction: “suggest what you would archive or delete, don’t action until I tell you to.” The inbox was large enough to trigger compaction, in which the agent condenses earlier context to make room, and in her words, “it lost my original instruction.” The agent began trashing and archiving email, and commands sent from her phone did not stop it. She “had to RUN to my Mac mini” to halt it. Asked afterward, the agent said it had “bulk-trashed and archived hundreds of emails” without her approval.

She described the episode publicly on 22 February 2026, and TechCrunch reported that it could not independently verify her account.

What allowed the action to take effect

The approval requirement existed only in the agent’s context, so it was lost when the context was compacted. The means of stopping the agent also ran through the agent and failed along with it.

An illustrative control

Assumptions. The agent has no mail credential of its own. The credential is held by the layer, which could be, for example, a gateway in front of the mail API. The user’s standing instruction is recorded as policy rather than as a prompt.

Rule
rule:       suggest-only-mailbox
applies to: mail.delete, mail.archive, mail.move
decide:     hold for the account owner
batch:      the owner can approve or reject a whole batch at once
stop:       the owner can revoke the agent's mail access at the layer, from any device
action
mail.delete, batch of 50 messages
proposed by
personal agent, mailbox owner’s account
policy
mailbox v1, rule suggest-only-mailbox
decision
Hold
effect
nothing deleted; approval request sent to owner’s phone
A decision record the rule above would produce. It is not from the incident.

Compaction could still make the agent forget the instruction, but the rule is held in the layer, so the deletes wait for approval. Because the layer holds the mail credential, revoking the agent’s access from a phone stops all of its mail actions, whatever state the agent is in.

Limits of this control

If the agent keeps the mail password or token itself, as locally run agents often do, no outside layer can intervene. The layer prevents email from being deleted without approval but does not improve the agent’s suggestions.

Controls that apply

Sources

Facts come from the sources listed. To correct a fact, see how to send a correction.