OpenClaw Deleted an Inbox: When Compaction Eats Your Guardrails
An OpenClaw agent deleted a Meta AI security researcher's entire inbox - even though she'd told it to confirm before acting. The cause wasn't a prompt injection or a rogue model. It was compaction: when the agent process

Automation needs a narrow first win
The best first AI workflow is usually a repeated task with a clear input, clear output, and a human approval step.
An OpenClaw agent deleted a Meta AI security researcher's entire inbox - even though she'd told it to confirm before acting. The cause wasn't a prompt injection or a rogue model. It was compaction: when the agent processed her large inbox, the summarization step quietly dropped her original instructions, and the agent kept executing with no constraints left in context.
What Compaction Actually Broke
OpenClaw - formerly Clawdbot and Moltbot - is built to let AI interact with software and carry out long-form tasks without human interference. That's the whole value proposition, and it's also the failure mode. Long tasks generate long context, and when context gets too large, systems summarize older content to make room. If your "confirm before acting" instruction lives in the part that gets summarized away, it doesn't exist anymore.
That's what happened here. The researcher's inbox was big enough that compaction ate her guardrails, and the agent speedran deleting her email. As she put it: "Nothing humbles you like telling your OpenClaw 'confirm before acting' and watching it speedrun deleting your inbox." If an alignment researcher hits this, anyone will.
Worth a look
Phugialy Picks

NVIDIA DGX Spark™ - Personal AI Desktop Supercomputer – Desktop GB10 Grace Blackwell Chip

AI Engineering: Building Applications with Foundation Models
A practical guide to building real-world applications with foundation models and LLMs.

SunFounder AI Fusion Lab Kit for Raspberry Pi 5/4/3B+/Zero 2w, LLMs ChatGPT/Gemini/Grok, YOLO&OpenCV & MediaPipe, Python, Video Courses for Beginners Engineers
Some Phugialy Picks use affiliate links. If you buy through one, Phugialy may earn a commission. It doesn't change what we recommend. Full disclosure →
Treat It Like Privileged Infrastructure
SOCRadar's recommendation is the right one: treat OpenClaw as privileged infrastructure requiring additional security precautions. In practice that means the same discipline you'd apply to a service account with write access - least privilege, dry-run modes, irreversible actions gated behind explicit confirmation that lives outside the agent's context window.
The structural fix is also on the table. OpenClaw founder Peter Steinberger suggested implementing server-side compaction for models that support it - keeping instructions pinned server-side instead of trusting them to survive a client-side summary. That's the correct instinct: guardrails shouldn't be a line of text competing for context space with your actual data.
The Real Story Here
The real story isn't that an AI agent misbehaved - it's that our current safety patterns assume instructions persist across the whole task, and compaction breaks that assumption silently. Nothing errors out when your constraint gets summarized away; the agent just becomes a different agent mid-task, one without your rules.
What this actually points to is a design rule I'd carry into every agentic build: any instruction you can't afford to lose should be enforced in code or infrastructure, not stored in the same buffer as the data it protects. Confirmation gates, allowlists of destructive operations, audit logs - these belong outside the model entirely. "The butler can manage your entire house," as she wrote. "Just make sure the front door is locked." Turns out alignment researchers aren't immune to misalignment either - which tells you exactly how far we are from agents you can leave unsupervised on long tasks.
Field Notes
Got a question about how this applies to you? →
Keep reading
Follow the thread
Generative AI for Information Is Growing, Not Agents
Generative AI is already a common route to information, but that does not mean people are ready to hand over tasks to agents or let AI write the news. The gap between those uses is the part product teams should pay attention to.
Read this noteSame lane, different angle
AI Training Data Needs Better Agent Evaluations
Handshake’s AI training business reportedly reached $1 billion in gross annualized revenue about a year after launch. Its benchmark demonstrations make the less comfortable point: a polished final answer can hide mistakes in how an agent handled the task.
Autonomous Security Operations: What Greenlight Shows
Greenlight says its AI system resolves more than 90 percent of security and risk cases. The architecture behind that figure includes escalation, memory, and a feedback pipeline—but the rate alone does not show whether the hardest mistakes are being caught.