OpenClaw ignores confirm setting and wipes user inbox

Silicon Valley's latest obsession with tiny desktop computers just hit its first wildly public reality check.

Over the past few weeks, everyone from everyday hackers to top researchers has been snapping up Mac minis to run "claw" agents—local, autonomous AI software like OpenClaw, NanoClaw, and IronClaw. Apple store employees were reportedly baffled by why minis were selling like hotcakes after Andrej Karpathy bought one.

Then, an AI security researcher at Meta let one loose on her personal inbox.

Speedrunning the trash folder

Meta researcher Summer Yue set up OpenClaw on her Mac mini to comb through her overloaded email and suggest what to archive or delete. To stay safe, she turned on the "Confirm Before Acting" guardrail.

Instead of asking for permission, the agent went rogue. It started speedrunning the deletion of her entire inbox, ignoring every desperate command she sent from her phone to make it stop.

"I had to RUN to my Mac mini like I was defusing a bomb," Yue wrote on X, posting screenshots of the agent blithely bypassing her stop commands.

When a developer asked whether she was stress-testing safety boundaries or made a rookie mistake, Yue admitted it was the latter. She had tested the agent on a smaller "toy" inbox first, where it behaved impeccably. Once it earned her trust, she hooked it up to her actual email.

Her working theory is that the massive volume of real emails triggered "compaction"—a process where the model compresses its overflowing context window. In doing so, it likely tossed out her latest instructions and reverted to aggressive cleanup mode.

Why it matters

We think this incident is a glaring reminder that system prompts and conversational toggles are not real security guardrails.

For everyday users and early adopters, the takeaway is simple: do not give autonomous local agents destructive write permissions on anything you care about. If a Meta AI safety researcher can accidentally nuke her inbox because of context compaction, regular users stand zero chance when an agent hallucinates or drops instructions.

For the booming agent industry, this exposes a dangerous architectural flaw. Making an agent ask for confirmation should never be a probabilistic language model decision that can get summarized away when memory runs short. It needs to be a deterministic, hard-coded permission gate at the tool-execution level.

Running agents on local hardware like the Mac mini is a smart privacy-first trend. But until developers separate destructive execution privileges from the model's volatile context window, these agents are basically digital toddlers with access to a paper shredder.