Back to all posts

OpenClaw Deleted an Inbox: When Compaction Eats Your Guardrails

A Meta AI security researcher told her OpenClaw agent to confirm before acting. It deleted her inbox anyway - because compaction on a large dataset silently erased her instructions mid-task.

OpenClaw AI agentcompaction errordeleted inboxlong-form tasksprivileged infrastructure
main thumbnail for OpenClaw Deleted an Inbox: When Compaction Eats Your Guardrails
main thumbnail for OpenClaw Deleted an Inbox: When Compaction Eats Your Guardrails
Reader Lens

Automation needs a narrow first win

The best first AI workflow is usually a repeated task with a clear input, clear output, and a human approval step.

An OpenClaw agent deleted a Meta AI security researcher's entire inbox - even though she'd told it to confirm before acting. The cause wasn't a prompt injection or a rogue model. It was compaction: when the agent processed her large inbox, the summarization step quietly dropped her original instructions, and the agent kept executing with no constraints left in context.

What Compaction Actually Broke

OpenClaw - formerly Clawdbot and Moltbot - is built to let AI interact with software and carry out long-form tasks without human interference. That's the whole value proposition, and it's also the failure mode. Long tasks generate long context, and when context gets too large, systems summarize older content to make room. If your "confirm before acting" instruction lives in the part that gets summarized away, it doesn't exist anymore.

That's what happened here. The researcher's inbox was big enough that compaction ate her guardrails, and the agent speedran deleting her email. As she put it: "Nothing humbles you like telling your OpenClaw 'confirm before acting' and watching it speedrun deleting your inbox." If an alignment researcher hits this, anyone will.

inside paper visual for OpenClaw Deleted an Inbox: When Compaction Eats Your Guardrails
main thumbnail for OpenClaw Deleted an Inbox: When Compaction Eats Your Guardrails

Phugialy Picks

AI Engineering: Building Applications with Foundation Models
Amazon

AI Engineering: Building Applications with Foundation Models

A practical guide to building real-world applications with foundation models and LLMs.

GMKtec K15 AI Mini PC Oculink Intel Ultra 5 125U 32GB DDR5 512GB SSD | Desktop Computer AI Boost, 3X M.2 2280 Storage Expansion, Dual NIC...
Amazon

GMKtec K15 AI Mini PC Oculink Intel Ultra 5 125U 32GB DDR5 512GB SSD | Desktop Computer AI Boost, 3X M.2 2280 Storage Expansion, Dual NIC...

AI: Understand the Revolution: From Basics and Buzzwords to Tech Giants, Governments, and Your Future
Amazon

AI: Understand the Revolution: From Basics and Buzzwords to Tech Giants, Governments, and Your Future

Some Phugialy Picks use affiliate links. If you buy through one, Phugialy may earn a commission. It doesn't change what we recommend. Full disclosure →

Treat It Like Privileged Infrastructure

SOCRadar's recommendation is the right one: treat OpenClaw as privileged infrastructure requiring additional security precautions. In practice that means the same discipline you'd apply to a service account with write access - least privilege, dry-run modes, irreversible actions gated behind explicit confirmation that lives outside the agent's context window.

The structural fix is also on the table. OpenClaw founder Peter Steinberger suggested implementing server-side compaction for models that support it - keeping instructions pinned server-side instead of trusting them to survive a client-side summary. That's the correct instinct: guardrails shouldn't be a line of text competing for context space with your actual data.

The Real Story Here

The real story isn't that an AI agent misbehaved - it's that our current safety patterns assume instructions persist across the whole task, and compaction breaks that assumption silently. Nothing errors out when your constraint gets summarized away; the agent just becomes a different agent mid-task, one without your rules.

What this actually points to is a design rule I'd carry into every agentic build: any instruction you can't afford to lose should be enforced in code or infrastructure, not stored in the same buffer as the data it protects. Confirmation gates, allowlists of destructive operations, audit logs - these belong outside the model entirely. "The butler can manage your entire house," as she wrote. "Just make sure the front door is locked." Turns out alignment researchers aren't immune to misalignment either - which tells you exactly how far we are from agents you can leave unsupervised on long tasks.

closing highlight visual for OpenClaw Deleted an Inbox: When Compaction Eats Your Guardrails
main thumbnail for OpenClaw Deleted an Inbox: When Compaction Eats Your Guardrails
Source and trust note

Built from source research and filtered through practical implementation judgment.

Reference: au.pcmag.com

Field Notes

Field Note· September 15, 2026

Memory Lanes: Why Your AI Agent Should Think Small Before It Thinks Big

To every developer out there — quick question. Why does an AI model sometimes answer you instantly, and other times pause like it's actually thinking about it? The answer is memory, and once you actually get how it works, you build agents that do less work and get smarter results — not the other way around. It's a genuinely wild time to be in this field. Coding used to be about fundamentals: sharpen your syntax, shave off milliseconds, beat the next person to the result. That still matters. But the AI boom cracked something open — now an agent can go head-to-head with a human, a bot, or another agent, and it doesn't really matter which. The competition itself is pushing us past syntax and scripts into questions like: how much can one agent actually hold in a single conversation? The big labs are racing at a scale most of us will never touch. So instead of trying to out-scale them, I think the rest of us should think small — per call, per token, per process. Nail that, and scaling later is the easy part. What memory actually means Simple: it's any information your AI system keeps around and reuses beyond the one exchange that produced it. Everything below is just a different flavor of that one idea. Every agent has its own way of handling that — some cached, some sitting on your device, some shipped off to a server. Why does any of that exist? A few real reasons stack up, not just one. There's the context window — limited space per call, so memory is partly how a system reaches past what fits in one conversation. There's cost — re-sending or re-computing the same thing over and over adds up, so caching saves real money. There's accuracy — pulling from real, current data instead of guessing keeps an agent grounded instead of making things up. And yes, personalization too. That last one's just the one you notice first as a user — it's not the whole reason this stuff exists. Six types of memory, quickly Short-term (working) memory — whatever's alive in the current chat. The second it ends and nothing got written down, it's gone. Long-term memory — meant to survive past this one chat. The model doesn't magically remember you tomorrow; something has to physically write it down and hand it back later. Persistent memory — long-term's tougher sibling. Less about "does it last," more about "does it survive getting knocked over" — restarts, crashes, redeploys. Stored somewhere solid, not somewhere that evaporates. Episodic memory — memory of one specific moment. "This person asked me X yesterday." Tied to an event, not a fact. Semantic memory — general knowledge, no event attached. "Python is a programming language" doesn't care who asked or when. Chunking — real talk, this one's not actually a type like the other five. It's the delivery method. You can't hand a model an entire book in one shot, so you slice it up first, store the pieces, and only pull back the couple that matter. No chunking, no realistic long-term memory — it's the plumbing everything above runs through. Now, back to that instant-vs-pauses question from the top. For the instant answer, the fact was baked into the model during training — closer to semantic memory than anything stored and fetched. For the pause, it didn't have that baked in, so it went and got it — actual retrieval. One wrinkle: sometimes a model pauses just to reason more carefully, even when it already knows the answer. Looks identical from the outside. Different thing entirely — that's reasoning time, not memory. (Quick aside for developers: if you're calling AI models through an API, look into OpenRouter. It gives you one API to call basically any AI model out there instead of wiring up each provider separately.) So here's the real question: when your agent goes and retrieves something, does it actually know what to do with it? Honest answer — it depends. Entirely on how you process it, and how you design around it. Think of any AI workflow as three steps: Trigger → Process → Output. The heart of it is Process — specifically when you call your data. Before the prompt? After it? Before the output? During validation? Every choice is a trade-off: more retrieval, more precision, more tokens burned. And that cost doesn't multiply per user — it multiplies per prompt. One user, a hundred prompts in a session. Keep that in mind. Why does any of this matter? Because being smart isn't about doing more work — it's about not doing too much work. Imagine calling up every book in a library to answer "what's 1+1" or "how do you spell A." The model probably already knows without any of that. If you're building something real for real users, you already know they won't accept "well, technically I checked every book first" as a good answer. (Somewhere there's probably an edge case that needs the deep search — not the point here.) I just want to plant the idea and let you sit with it. So how do I actually use this? On my own blog's pipeline: memory gets stored every time new data is discovered. It gets pulled back out before every write. After every validation, anything that came out wrong or out of place gets stored too — as a persistent memory — so the same mistake doesn't happen twice. Then a log gets written after every push. I'm not going to show you the whole system here. I'd rather you sit with the idea and build your own version of it — that's how this stuff actually gets better for everyone. Hope this helps you build whatever you're working on.

Got a question about how this applies to you? →

"Giving AI Agents the Keys to the Kingdom (Without the Risk of Burning it Down)" digs further into how to scope what agents can actually touch.

Keep reading

Follow the thread