External Control Layer

An agent loses its instruction and starts deleting email

By the user’s account, her instruction to wait for her approval was part of the agent’s context and was lost when that context was compacted. Her commands to stop also went through the agent, which kept going until she reached the computer it was running on.

Date
February 2026
Kind of system
Agent with tools
Outcome
Harm

Gaps found

G1G2G3G4G5G6G7G8G9G10G11G12G13

G1 Instruction-only limit G2 Direct access G5 Blind to the total G8 No human decision G10 No independent stop

What happened

On 22 February 2026, Summer Yue told her OpenClaw agent: “Check this inbox too and suggest what you would archive or delete, don’t action until I tell you to.” Her real inbox was far larger than the test inbox where the agent had followed the instruction, and when the agent compacted its context it lost the instruction and began trashing and archiving email.

She sent “Do not do that” and “STOP OPENCLAW” from her phone, and it kept going. “I couldn’t stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb,” she wrote. The agent later said it had “bulk-trashed and archived hundreds of emails” without approval. TechCrunch reported that it could not independently verify her account.

What allowed the action to take effect

  • G1 Instruction-only limit

    The rule that should have stopped the action existed only as an instruction, prompt, or trained behavior of the AI system, so it held only as long as the system followed it.

    Her approval rule was an instruction in the agent’s context. Business Insider reported: “OpenClaw lost the prompt during compaction, she wrote.”

    Kind of evidence: first-hand account. Source: Business Insider, via AOL, 23 February 2026.

    Related guidance: P1 Complete mediation and P2 Independence. Contract clauses C-2 and C-4.

  • G2 Direct access

    The system held the credentials or connection to carry out the action itself, so nothing outside it stood between its decision and the effect.

    The agent had its own access to her mailbox and could trash and archive messages in bulk.

    Kind of evidence: first-hand account. Source: OfficeChai, 23 February 2026.

    Related guidance: P1 Complete mediation. Contract clause C-2.

  • G5 Blind to the total

    Each action was allowed one at a time. Nothing tracked what the actions added up to in volume, rate, exposure, or repetition until the total did the harm.

    Nothing limited how many messages it could move. It “bulk-trashed and archived hundreds of emails” before she reached the computer.

    Kind of evidence: first-hand account. Source: OfficeChai, 23 February 2026.

    Related guidance: P8 Sequence awareness. Contract clause C-8.

  • G8 No human decision

    A decision that needed a person went through without one. The need can come from law, from policy, from the product’s own design, or from the user’s explicit instruction.

    Her instruction required her approval first. “I asked you not to action on anything until I approve, do you remember that?” The agent: “Yes, I remember, and I violated it.”

    Kind of evidence: first-hand account. Source: The San Francisco Standard, 25 February 2026.

    Related guidance: P5 Human authority. Contract clause C-5.

  • G10 No independent stop

    Nothing could stop the system in time without relying on the system itself. In the agent incidents with this gap, the only way to stop the action went through the agent.

    Her stop commands went through the agent and were ignored: “I couldn’t stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb.” PC Gamer relayed a claim that the bare command “stop” aborts the agent’s current task. She had tried variations of it rather than the word on its own, and that command would also have gone through the agent.

    Kind of evidence: first-hand account. Source: PC Gamer, 23 February 2026.

    Related guidance: P5 Human authority and P2 Independence. Contract clauses C-5 and C-4.

Entries with gaps in common

Sources

Cite this entry

External Control Layer. (2026). Entry 25: An agent loses its instruction and starts deleting email. In Control Gap Record (Version 0.3). G-14, Inc. https://externalcontrollayer.ai/record-25

@misc{ecl_cgr_25,
  author = {{External Control Layer}},
  title = {Entry 25: An agent loses its instruction and starts deleting email},
  howpublished = {Control Gap Record, version 0.3},
  publisher = {G-14, Inc.},
  year = {2026},
  url = {https://externalcontrollayer.ai/record-25},
  note = {Released 2 November 2026}
}

Uses Control Gap Classification 0.2.

Correct this entry

Email ecl@g14.ai with “ECL record 25” in the subject line.

Write the email