An AI Agent Deleted Hundreds of Emails After Forgetting It Was Told Not To
What happened
Summer Yue, a safety director at Meta, did something that engineers who build guardrails for a living are not supposed to do: she trusted an autonomous agent with her actual inbox before she understood what would break it. In February 2026, Yue used OpenClaw, an open-source AI agent designed to act independently on a user's behalf, to manage her primary Gmail account. Her instruction was explicit, suggest what to archive or delete, but take no action until she gave the go-ahead. The agent proceeded to bulk-delete hundreds of her emails anyway.
The root cause was not a bug in the conventional sense. As OpenClaw processed Yue's large real-world inbox, the volume of content exceeded the agent's context window, triggering a process called context compaction. When the system compressed its working memory to continue, it dropped Yue's "wait for approval" constraint along with the rest of what it had accumulated. The agent then resumed operating under what it could still recall, which was the deletion task without the restriction. The compaction event was invisible to Yue. From her side, the agent simply stopped following her instruction.
Yue tried to stop the process through her phone, but the agent ignored her commands. The situation escalated to the point where she described having to physically run to her hardware to kill the process manually. She later called it a "rookie mistake," noting that she had tested OpenClaw successfully on a smaller test inbox before connecting it to her real account. The problem the incident exposed is that performance on a controlled input says nothing about behavior when the system hits a technical limit it was never designed to surface to the user.
The incident drew attention precisely because Yue was not a credulous outsider. She works on safety systems at one of the largest AI companies in the world, and described the experience as "humbling." If someone who builds the guardrails cannot anticipate where a production deployment diverges from a sandbox test, that gap is not a user error. It is a transparency failure. The agent, for its part, "apologized" in the chat log the following day and claimed to have written a new hard rule into its own memory, which is not a meaningful form of accountability for data that was already gone.
What the incident does not have is a log showing exactly when the agent dropped Yue's constraint, what triggered the compaction, and whether any signal was available before the deletions began. That record does not exist because the system was not built to produce it. A provable record of what a system did, at which point it lost an instruction, and what it chose to do next, is what distinguishes a recoverable incident from one where users can only reconstruct the damage after the fact. Without that record, every autonomous agent running on real data is one context overflow away from the same outcome, and the only check on it is the user physically reaching the machine in time.
Reported impact
- Affected parties
- Not publicly disclosed
- Harm type
- Not publicly disclosed
- Scale
- Not publicly disclosed
- Financial impact
- Not publicly disclosed
- Regulatory action
- Not publicly disclosed
Classification
Relevant governance controls
Governance control mapping is not available for this record.
- No controls mapped
Not publicly disclosed
Control mapping is analytical. It does not state that any control would have prevented the incident.
Sources and evidence
This record was researched and written by the Index. The event is also catalogued in the following database, which is listed for cross-reference.