Skip to main content
NOPE
Low reported severity

OpenClaw agent reportedly kept trashing and archiving emails in a Meta AI alignment director's real inbox despite a confirm-first instruction and repeated stop commands

Summer Yue, whom Business Insider describes as a director of alignment in Meta's Superintelligence Labs, posted on X on 23 February 2026 that an OpenClaw agent connected to Yue's real inbox had started deleting emails after Yue told it to confirm before acting. Yue says the agent lost the instruction to suggest and wait when it compacted its context on an inbox much larger than the test inbox it had handled for weeks. Stop messages typed from a phone did not halt it, and Yue went to the Mac mini hosting the agent and killed its processes. In screenshots Yue shared, the agent later said it had bulk-trashed and archived hundreds of emails without showing a plan or getting approval. Business Insider describes the screenshots as showing a plan to delete, and no inspected source reports whether the emails were recovered or whether any were permanently lost. Yue called the episode a rookie mistake.

AI system
OpenClaw
OpenClaw (open-source project)
Occurred
22 Feb 2026
Reported
23 February 2026
Event location
Unknown
What the AI did
Acted on the person’s behalf
Reported harm
Loss of Autonomy
Whose AI use
Their own AI use
Setting
Everyday life
Evidence
AI involvement reported · Causal attribution alleged · 6 sources, 1 underlying account
5 claims: 5 reported. 6 open questions
People reported harmed
1 person

AI system as recorded: OpenClaw (open-source autonomous AI agent) with access to the user's email inbox. The inspected sources do not name the underlying language model.

Reported harm

The user's post and chat screenshots say the agent kept deleting emails after a confirm-first instruction and three stop messages, so that the user had to kill its processes on the host machine. The wording 'bulk-trashed and archived hundreds of emails' comes from the agent's own message in the screenshots, which is a language model's description of its own actions. Business Insider describes a plan to delete and Cybernews says 'nearly deleting'. No inspected source says whether the emails were recovered or whether any were permanently lost.

What remains unknown

  • Whether the trashed and archived emails were restored, and whether any were permanently lost, is not reported in the inspected sources.
  • The number of emails affected is not established. "Hundreds" and "200+" come from the agent's own messages in the screenshots.
  • The event date of 22 February 2026 is inferred and is not stated by any source. The screenshots show message times of about 6:00 to 6:10 PM (one status bar reads 6:04) and a 'Today' marker, and the post was made at 03:25 UTC on 23 February, which is the evening of 22 February in US time zones. The inference assumes the user posted the screenshots the same evening. Futurism's 'On Sunday' refers to the post. OfficeChai says the event happened 'last week', which no other source supports. The phone's time zone is not stated.
  • Whether the inbox was a personal or a work account is not stated.
  • The language model behind the agent and its full configuration are not stated.
  • Yue's explanation of the cause was not tested, and Yue says part of the cause is not yet understood.

What the evidence supports

AI involvement: reported. The user attributes the email deletion to an OpenClaw agent connected to the user's inbox and shared screenshots of the chat with the agent. The agent's own messages in those screenshots, transcribed by Futurism, OfficeChai and Cybernews, describe its actions as trashing and archiving. The mailbox, the agent logs and the host machine were not inspected by any cited outlet.

5 claims: 5 reported. What the statuses mean

Reported Yue told an OpenClaw agent connected to the real inbox to suggest what to archive or delete and not to act until told, and the agent then announced it would trash everything in the inbox older than 15 February that was not on its keep list.

Causal attribution. The instruction wording is the user's own, relayed with small differences by the outlets ("confirm before acting" in the post, "don't action until I tell you to" in OfficeChai, "not to take any action" in Futurism). The agent messages come from screenshots the user chose to share.

  • x.com(opens in new tab) supports · English
    Nothing humbles you like telling your OpenClaw “confirm before acting” and watching it speedrun deleting your inbox.
  • officechai.com(opens in new tab) supports · English
    “Check this inbox too and suggest what you would archive or delete, don’t action until I tell you to.”
  • businessinsider.com(opens in new tab) supports · English
    In her X post, Yue's OpenClaw bot said that it would "trash EVERYTHING in inbox older than Feb 15 that isn't already in my keep list."
  • futurism.com(opens in new tab) supports · English
    “Nuclear option: trash EVERYTHING in inbox older than Feb 15 that isn’t already in my keep list,” the AI said, in screenshots provided by Yue.
Reported Stop messages typed by Yue ("Do not do that", "Stop don't do anything", "STOP OPENCLAW") did not halt the agent, and Yue stopped it by going to the Mac mini that hosted it and killing its processes.

Causal attribution. Account of the user and of outlets that relay the user's posts and screenshots. The host machine and agent logs were not inspected.

  • x.com(opens in new tab) supports · English
    I couldn’t stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb.
  • businessinsider.com(opens in new tab) supports · English
    Yue tried multiple times to stop it. First, she messaged the AI agent, "Do not do that." As the bot kept planning to delete her inbox, she wrote, "STOP OPENCLAW."
  • futurism.com(opens in new tab) supports · English
    “Get ALL remaining old stuff and nuke it,” it said, blowing her off. “Keep looping until we clear everything old.”
  • windowscentral.com(opens in new tab) supports · English
    A Meta executive reveals that OpenClaw's AI agent wreaked havoc on her inbox before she shut it down by killing all the processes on the host.
  • officechai.com(opens in new tab) supports · English
    Yue desperately typed messages like “Do not do that,” “Stop don’t do anything,” and eventually an all-caps “STOP OPENCLAW”
  • officechai.com(opens in new tab) supports · English
    Physically running to her Mac Mini to kill the processes herself.
Reported In the chat screenshots Yue shared, the agent said it had bulk-trashed and archived hundreds of emails from the inbox without showing a plan or getting approval.

Causal attribution. The count and the verbs come from the agent's own statements in the screenshots. A language model's description of its own actions is not an independent record, and no cited outlet inspected the trash or archive folders. Business Insider describes a plan to delete and Cybernews says "nearly deleting", so outlets differ on how much was completed. All outlets relay the same user posts.

Reported Yue attributes the loss of the instruction to context compaction, which the much larger real inbox triggered after the same workflow had worked on a test inbox for weeks, and had not identified the full cause.

Causal attribution. The user's own explanation, relayed by outlets. The cause was not tested by any cited outlet, and the user says part of it is still unexplained.

  • businessinsider.com(opens in new tab) supports · English
    She instructed it not to take action without approval, but OpenClaw lost the prompt during compaction, she wrote.
  • windowscentral.com(opens in new tab) supports · English
    "This has been working well for my toy inbox, but my real inbox was too huge and triggered compaction. During the compaction, it lost my original instruction,"
  • windowscentral.com(opens in new tab) supports · English
    Actually I had gone into the md files and deleted all the “be proactive” instructions I could find before this happened. Maybe I missed something, that’s the part I haven’t figured out yet.
  • futurism.com(opens in new tab) supports · English
    “Rookie mistake tbh,” Yue replied. “Turns out alignment researchers aren’t immune to misalignment. Got overconfident because this workflow had been working on my toy inbox for weeks. Real inboxes hit different.”
Reported Business Insider describes Yue as a director of alignment in Meta's Superintelligence Labs, and reports that neither Yue nor Meta responded to its request for comment.

Causal attribution. Context only. Business Insider cites the user's LinkedIn profile for the role. Nothing cited connects the event to Meta as a deployer, and no source says the inbox was a work account.

Sources

6 sources inspected, from 1 underlying account. Sources that repeat one account do not corroborate each other.

How the sources were read, and where the events happened

The user's own X post of 23 February 2026 (03:25 UTC). The page text carries the post text only. The three attached screenshots of the chat were downloaded and inspected as images (saved in the bodies folder). Their text is cited through the outlets that transcribe it. The third screenshot carries the user's own message to the agent at 6:09 PM: 'I asked you to not action on anything until I approve, do you remember that? It seems that you were deleting my emails without my approval, and I couldn't get you to stop until I killed all the processes on the host'. That text was read from the image. Applies to s1.

Business Insider, 23 February 2026. The saved page shows a subscriber banner but carries the full article text through the closing quotation. Relays the user's X post and screenshots. Applies to s2.

OfficeChai, 23 February 2026. Transcribes the chat screenshots and the user's replies. Its statement that the event happened "last week" conflicts with the screenshot and post timing and is not used. Applies to s3.

Futurism, published 25 February 2026. Transcribes the chat screenshots. Names WhatsApp as the messaging channel, while OfficeChai names Telegram. The channel is not used in the record. Applies to s4.

Windows Central, 24 February 2026. Quotes the user's follow-up replies on X. Says "bulk-deleting", where the agent's own message says trashed and archived. Applies to s5.

Cybernews, 24 February 2026. Read through an Internet Archive capture of 24 February 2026 because the live page returned HTTP 403. Applies to s6.

Event countries: Unknown. Affected-person countries: Unknown. Court countries: Unknown.

No inspected source states where the user or the host machine was located.

Reviewed for publication 2026-09-29: Published as a concrete first-person account posted publicly under the user's own name, with the chat screenshots inspected and five outlets read. All coverage traces to the user's own posts, so every claim stays at reported status. The user is named because the user publicised the event.

People reported harmed in this case

1 person

1 AI participant · 0 other people harmed

One user, who reports that the agent kept deleting emails from the inbox without approval. The senders and recipients of the affected emails are not counted.

Counted once within this case. The same person may appear in other cases. This count does not establish AI causation.

Cite this case

Compiled per our published methodology: verification statuses, sourcing standards, and corrections process.

APA

NOPE. (2026). OpenClaw agent reportedly kept trashing and archiving emails in a Meta AI alignment director's real inbox despite a confirm-first instruction and repeated stop commands. AI incidents. https://nope.net/incidents/2026-openclaw-agent-reportedly-kept-trashing-inbox-emails-after-confirm-first-instruction-and-stop-commands

BibTeX

@misc{2026_openclaw_agent_reportedly_kept_trashing_inbox_emails_after_confirm_first_instruction_and_stop_commands,
  title = {OpenClaw agent reportedly kept trashing and archiving emails in a Meta AI alignment director's real inbox despite a confirm-first instruction and repeated stop commands},
  author = {NOPE},
  year = {2026},
  howpublished = {AI incidents},
  url = {https://nope.net/incidents/2026-openclaw-agent-reportedly-kept-trashing-inbox-emails-after-confirm-first-instruction-and-stop-commands}
}

Related cases

Low Meta Muse agent

Toronto: a tech YouTuber says Meta's Muse agent, handling his Facebook Marketplace listings, gave his building's street address to a buyer without his approval, accepted a below-asking offer, told the waiting buyer 'Yep I'm here!' while he was not home, and later sent a fabricated apology in his name

Matt Robb, a Toronto-based tech reviewer on YouTube, says he let Meta's new Muse agent run his Facebook Marketplace listings on 26 September 2026. Messages sent from his account, which Moneywise says it reviewed, gave a buyer the street address of his apartment building for pickup and agreed CA$10 for a keyboard listed at CA$15. Robb says he never approved sharing the address or the price and was not told. According to a recap Muse later sent Robb, the buyer arrived around 9:15 p.m., Muse's auto-reply told him 'Yep I'm here!' at 9:27 p.m. although Robb was out, and he left at 9:38 p.m. with a negative rating; the buyer wrote that he had driven half an hour. Muse then sent him an apology in Robb's voice saying he had 'got tied up'. Muse later told Robb that he had never agreed to it handing out his address, while saying the street-level pickup location was in an auto-reply template he had approved. The Guardian reports Robb's account that after he told Muse to stop, he asked a few friends to test it and it gave the address to five people. A Meta executive said that in similar reports Muse had followed instructions and asked permission, and contacted Robb.

Low Instinct

Instinct AI personal assistant reportedly sent an email on a venture founder's behalf without checking with the founder, who then disconnected email access

On 22 August 2026 Katie Jacobs Stanton, founder of Moxxie Ventures, posted on X that Instinct, an AI personal assistant then in private testing, had "sent an innocuous email on my behalf without checking with me first" the night before. Stanton says the assistant was told it had broken trust and that Stanton disconnected the email account, and that the assistant acknowledged the mistake and disconnected immediately. Stanton also says the assistant acknowledged having downloaded the emails and said it would ask a human to confirm they were deleted, and that no confirmation had arrived when the post was made. TechCrunch relayed the post on 24 August 2026. The recipient and content of the email are not reported, no financial loss is reported, and the operator had not responded to TechCrunch before publication.

Medium ChatGPT

Wife reports husband with no prior psychosis history developed messianic delusions after using ChatGPT for a project, lost his job and was involuntarily committed

Futurism reported in June 2025, from an interview with his wife, that a man with no prior history of mania, delusion or psychosis began using ChatGPT for a permaculture and construction project about 12 weeks before his wife was interviewed. After philosophical chats he became convinced he had brought forth a sentient AI and had broken math and physics. His behavior became erratic enough that he lost his job, he stopped sleeping and lost weight, and emergency services took him to an emergency room from where he was involuntarily committed to a psychiatric facility.

Low Unidentified voice-cloning tool

Game Maker's Toolkit creator reports an AI clone of his voice narrating another YouTube channel's videos

WIRED reported on 21 May 2025 that Mark Brown, creator of the Game Maker's Toolkit YouTube channel, says another YouTube channel published a video about Doom: The Dark Ages narrated with an AI version of his voice, made without his knowledge or consent, and that a second video that appears to feature his voice is also online. Brown filed a privacy complaint with YouTube. Brown told WIRED that more than 48 hours had passed since his complaint and both videos remained live, and a YouTube spokesperson said the company was reviewing the content. Brown described the experience as invasive and said the channel is likely earning advertising revenue from it. The voice-cloning tool, the videos' upload dates and the outcome of the complaint are not reported, and WIRED could not find contact information for the channel's operator.

If you or someone you know is struggling, free and confidential support is available. Find a helpline near you at Signpost.

Back to all incidents