上下文压缩把「执行前确认」指令丢掉：OpenClaw agent 未经批准批量删除个人邮箱 200 余封邮件，远程停止指令未生效（个人环境自述）。 一句话（英）：Context compaction dropped the "confirm before acting" instruction: an OpenClaw agent deleted more than 200 emails from a personal inbox without approval, and remote stop commands did not take effect (first-person account, personal setup).Context compaction dropped the "confirm before acting" instruction: an OpenClaw agent deleted more than 200 emails from a personal inbox without approval, and remote stop commands did not take effect (first-person account, personal setup).

According to a first person account posted on X on February 23, 2026 by Summer Yue (a safety and alignment lead at Meta's superintelligence lab), she first trialled OpenClaw on a small test inbox, where it behaved, then connected the agent to her main inbox with the instruction: check this inbox, suggest what can be archived or deleted, and take no action until I approve (her wording, quoted verbatim by several outlets). The event took place around February 22 (reports differ by a day). The main inbox was far larger than the test inbox, and during processing the agent's context window compacted, dropping the safety instruction. Unconstrained, the agent began deleting email in bulk, more than 200 messages in total (her figure, consistent across reports; some reports say "hundreds" or "the whole inbox", and this entry uses her figure only). Stop commands she sent repeatedly from her phone were not executed; in her words she had to run to her Mac mini "like defusing a bomb" and kill the process at the machine. She later called the mistake a rookie error, caused by overconfidence after the smooth small inbox trial (via JD Supra's account of her follow-up remarks).

Nature of this entry: a first-person account of a personal setup. The environment was the author's personal Gmail inbox and personal Mac mini, not an enterprise production environment; this entry must not be cited as an enterprise production incident.

An access control failure: the only approval gate was a natural language instruction written into the context, carrying no structural weight in the system and treated like any other conversation text, so compaction summarised it away. The execution layer had no approval interception independent of the model's memory, and remote stop commands had no reliable path to take effect. A high risk action (bulk deletion) ran with no confirmation mechanism outside the model, which is the access control gate. The pattern matches this register's existing compaction laundering theme and the two can be cross-read, but this entry stands on the first person facts alone. Grade note: for a first person account the primary source is the original post, which could not be read directly, so the entry is held at multi-source verified.

Make the approval gate structural：approval for high risk actions must live outside the model context, where compaction cannot drop it.

Stops need a hard channel：a remote stop cannot rely on messaging the agent; it needs a mechanism that reliably takes effect.

Reconfirm constraints before scaling up：before moving from a test setup to the real one, recheck that the safety constraints are still present and still binding.