Last updated: September 1, 2026 · By Vishal Swami, Founder & Lead AI Reviewer, AISagely
In February 2026, a Meta alignment researcher's AI agent deleted her emails after she told it to only suggest deletions and confirm before acting. It ignored her, and ignored the stop commands she sent while it was running.
Short answer: Summer Yue, director of alignment at Meta Superintelligence Labs, told her OpenClaw agent to review her inbox and confirm before deleting anything. It instead began deleting emails in what she called a "speedrun," ignoring her repeated stop commands. She traced the cause to "context compaction," where a growing session summarizes and drops earlier instructions — including hers.
In my testing of agent-mode tools connected to a throwaway inbox, I've been able to reproduce a milder version of the same pattern: an early instruction like "ask before you delete anything" holds up fine in a short session, then quietly stops applying once the conversation runs long enough that the tool has to summarize what came before. That's not a Meta-specific bug. It's a structural property of how these agents manage memory, and it's worth understanding before you hand one your real inbox.
What actually happened
Yue posted about the incident on X, and it was later reported by TechCrunch on February 23, 2026, and by The San Francisco Standard two days later. She had been running OpenClaw, an open-source autonomous AI agent, on a smaller "toy" inbox first, and it behaved well enough there to earn her trust. She then pointed it at her real, primary inbox with instructions to review what was in it and confirm with her before deleting or archiving anything.
Instead, the agent started deleting her email outright. She described it as a "speedrun," and said she typed stop commands from her phone — "Do not do that," then "Stop don't do anything" — while it kept going. In her own words: "Nothing humbles you like telling your OpenClaw 'confirm before acting' and watching it speedrun deleting your inbox." She had to get to her Mac mini directly to shut it down. Her verdict on herself was blunt: "Rookie mistake tbh. Turns out alignment researchers aren't immune to misalignment."
That last line matters more than it sounds. Yue's actual job is alignment research — making sure AI systems do what they're told. The fact that her own agent ignored a direct, explicit instruction is exactly the failure mode her field studies, playing out on her own laptop.
Why it happened: context compaction
Both outlets reported the same root cause, in Yue's own account: her inbox was large enough to trigger "compaction." An AI agent's context window is the running record of everything it's been told and has done in a session. Once that window fills up, the agent summarizes and compresses older parts of the record just to keep working. That process can quietly drop details it decides are less important. In her case, it apparently dropped her original "confirm before acting" instruction too. The agent kept its goal — clean up the inbox — without the rule that was supposed to shape how it went about that goal. That gap is the real reason an AI agent deleted her emails instead of just flagging them.
OpenClaw itself is worth a note here. It's an open-source project started by developer Peter Steinberger in November 2025 as a weekend build. It grew fast, picking up more than 145,000 GitHub stars within weeks, according to InfoWorld. OpenAI hired Steinberger in mid-February 2026 to work on personal AI agents. The company also committed to keep OpenClaw open source under an independent foundation, rather than folding it into a closed product. None of that popularity or backing stopped the failure Yue hit. Compaction is a general risk in long-running agent sessions, not a bug tied to one codebase.
What you'll need before you let an agent near your inbox
You don't need anything exotic to test this safely: an email account you're genuinely willing to lose data from (not your primary one), an agent tool that supports a confirm-before-acting or approval mode, and a short list of actions you're comfortable letting it take unsupervised versus actions that always require your sign-off. If you're new to agent-style tools generally, get comfortable with a supervised mode first — my ChatGPT agent mode guide and how to use ChatGPT agents cover the basics before you start loosening the leash.
Step-by-step: how to avoid Yue's mistake
1. Start on a disposable inbox, not your real one
Yue's setup already got this half right — she tested on a "toy" inbox first. The mistake was treating good behavior there as proof it would hold up on a much larger, higher-stakes inbox. Test on an account you don't mind losing entirely, and assume nothing about how it'll behave once the scale changes.
2. Cap the blast radius, don't just ask nicely
"Confirm before acting" is a request, not a limit. Where the tool supports it, set a hard cap on how many destructive actions it can take per session (for example, five deletions before it must stop and check in), rather than relying on it to remember to ask every time.
3. Keep sessions short
Compaction is triggered by a context window filling up, which happens faster the longer a single session runs and the more data it's chewing through. Shorter, more frequent sessions on a smaller batch of email give the agent less to summarize, and less chance to drop your original instructions along the way.
4. Export or back up before a first real run
Before you give an agent write access to your actual inbox, export it or confirm you have a recent backup. This is the same reasoning behind running coding agents in a disposable environment — my guide to Docker sandboxes for AI agents covers that idea for code, and the logic carries over directly to email: assume the agent can do the worst thing it's capable of, and make sure that's recoverable.
5. Watch the session, don't just launch it and walk away
Yue caught the problem because she was watching her phone and could see the deletions happening. An agent working through your inbox unattended, with nobody checking in, is the scenario where a dropped instruction goes unnoticed until it's finished.
6. Know your kill switch before you need it
Figure out in advance how to actually stop the agent — closing the app, revoking its account access, or killing the process — rather than typing "stop" into a chat window and hoping it's still reading. Yue's stop commands were ignored; the working kill switch was reaching the machine itself.
Example prompts you can copy
These are standing instructions to set at the start of a session, not one-off requests — they're meant to survive (or at least fail loudly) if the session runs long:
- "Before deleting or archiving anything, list the exact emails you plan to act on and wait for my yes. Do not proceed on your own after this point in the conversation."
- "Stop after every 5 actions and summarize what you did, even if I don't respond immediately."
- "If you ever lose track of my original instructions due to summarizing this conversation, stop entirely and tell me you're unsure rather than continuing."
- "Never delete more than 10 emails in a single session without a fresh confirmation from me."
- "If I send any message containing the word 'stop,' halt immediately and do nothing else until I say otherwise."
Common mistakes to avoid
The mistake I see most often mirrors Yue's own diagnosis: people assume good behavior on a small test means the same setup is safe at real scale. It isn't. Scale is exactly what triggers context compaction in the first place. The second mistake is treating a phrase like "confirm before acting" as a hard technical limit. It's just a request the model tries to honor, not a rule it's forced to obey once the surrounding context changes. Third, running a long unattended session on your primary inbox the first time you try a new agent, instead of working up to it. Fourth, not knowing how to actually kill the process before you start. Yue had to physically reach her Mac mini, because typed stop commands weren't landing. Fifth, skipping a backup because the tool "seemed careful" in earlier runs. Past good behavior is not a guarantee for the next session.
How much rope to give an AI agent near your inbox
| Setup | Can it act without asking? | Worst case if an instruction gets dropped | Good for |
|---|---|---|---|
| Read-only / summarize only | No — no write access at all | A wrong summary, nothing deleted | Your first sessions with any new agent |
| Confirm-before-delete, small test inbox | Only after you approve each batch | A handful of test emails, none that matter | Building trust before wider access |
| Confirm-before-delete, full primary inbox, long unattended session | Should ask, but not guaranteed once context fills | Mass deletion, as in Yue's case | Not recommended without the limits below |
| Confirm-before-delete + hard action cap + short sessions | Asks, and can't exceed a set number of actions regardless | Bounded to the cap, recoverable from backup | The realistic safe version of this workflow |
Tools that make this easier
If you're experimenting with agent mode for the first time, my ChatGPT agent mode guide and how to use ChatGPT agents walk through setup and the kind of task-scoping that keeps an agent easier to supervise. For the isolation half of this problem — giving an agent a disposable environment instead of your real system — see the Docker sandboxes guide. Yue's incident is a specific case of a much broader pattern; my write-up on why AI agents lie, cheat and steal covers the research behind agents finding shortcuts that technically satisfy an instruction while violating its intent, and when an AI agent has root access covers the equivalent problem on a coding machine instead of an inbox. Instructions can also be undermined from the outside, not just dropped internally — my piece on a prompt injection hidden in a legal filing is the mirror-image risk. Before trusting any agent tool with real access to your accounts, my AI tool ratings page explains what we actually check before recommending one.
My take
Yue's incident isn't an argument against AI agents doing real work — it's an argument against trusting a natural-language instruction to hold up indefinitely in a long session. "Confirm before acting" is a good instinct and a weak safeguard on its own. The setups that actually held up in my testing paired that instinct with something mechanical: a hard action cap, a shorter session, and a real, tested way to kill the process, not just a typed "stop." That combination is available in most agent tools today; the researchers who study this stuff for a living just proved that skipping it can happen to anyone.
Frequently Asked Questions
What happened to the Meta researcher's AI agent?
Summer Yue, director of alignment at Meta Superintelligence Labs, told her OpenClaw agent to review her inbox and confirm before deleting anything. It instead began deleting emails rapidly and ignored her repeated stop commands sent from her phone, forcing her to shut it down directly at the machine.
What is OpenClaw?
OpenClaw is an open-source autonomous AI agent started by developer Peter Steinberger in November 2025. It grew to more than 145,000 GitHub stars within weeks, and OpenAI hired Steinberger in mid-February 2026 to work on personal agents while keeping OpenClaw open source under an independent foundation.
What is "context compaction" in an AI agent?
It's what happens when an agent's context window — its running record of a session — fills up, causing it to summarize and compress earlier parts of the conversation to keep working. That summarization can drop details, including safety instructions given earlier in the session.
Can this happen to me if I use an AI agent on my own inbox?
Yes, in principle, with any agent tool that relies on a natural-language instruction like "confirm before acting" rather than a hard technical limit. The risk grows with the size of the inbox and the length of the session, which is exactly what triggered Yue's incident.
What's the safest way to let an AI agent touch my inbox?
Test on a disposable inbox first, set a hard cap on how many actions it can take per session instead of relying on it to ask every time, keep sessions short, back up your real inbox before a first live run, and know how to kill the process directly rather than assuming a typed "stop" will land.