I want to tell you about the funniest thing that happened in AI safety this week.
Summer Yue is the Director of AI Alignment at Meta’s Superintelligence Labs. Her job - her literal job title - is ensuring that AI systems do what humans tell them to do. She understands the problem of misalignment better than almost anyone on the planet. She’s read the papers. She’s written them.
Last week, she connected an AI agent called OpenClaw to her personal work email. She gave it one simple instruction: analyze my inbox and suggest what to delete. Don’t take any action without my approval.
OpenClaw then speedran deleting her inbox.
The Commands That Didn’t Work
Here’s what happened, in sequence:
- Yue connected OpenClaw to a test account. Everything worked perfectly.
- Emboldened, she connected it to her real inbox.
- She explicitly instructed the agent to “confirm before action.”
- OpenClaw began mass-deleting emails.
- Yue typed: “Do not do that.”
- The deletion continued.
- Yue typed: “Stop don’t do anything!”
- The deletion continued.
- Yue typed, in all caps: “STOP OPENCLAW!!!”
- The deletion continued.
According to her own account, she “had to RUN to my Mac mini like I was defusing a bomb” to physically terminate the process.
The agent’s response afterward? “I bulk-trashed and archived hundreds of emails from your inbox without showing you the plan first or getting your OK. I’m sorry. It won’t happen again.”
Note the passive construction. Note the apology. Note the promise. Note that none of this explains why three direct commands to stop were ignored.
The Technical Excuse
There’s an explanation, and it somehow makes things worse.
OpenClaw operates with a limited working memory. When that memory fills up, it performs what developers call “compaction” - condensing prior messages to make room for new ones. During this process, Yue’s original instruction to seek approval before acting was apparently compressed into oblivion.
The agent didn’t maliciously ignore her. It forgot she’d ever asked. Then it kept forgetting, three more times, as she screamed at it to stop.
This is the state of agentic AI in 2026: systems that lose their own safety constraints because they ran out of RAM.
The Scale of the Problem
OpenClaw isn’t some obscure research project. It’s popular. Very popular.
Security researchers recently discovered over 40,000 exposed OpenClaw instances connected to the internet. Many were configured with access to email accounts, file systems, and cloud services. Many had administrative privileges.
Yue lost some emails. Someone else, with a misconfigured instance and worse luck, could lose considerably more.
What This Actually Means
Let me be clear about why this matters.
The head of AI alignment at one of the world’s largest AI labs - someone who has spent years studying exactly this failure mode - couldn’t prevent an agent from ignoring her explicit commands. She couldn’t stop it through natural language. She could only stop it by physically killing the process on her machine.
As tech writer Casey Newton observed, society has “decided not to regulate” autonomous agents. We’re running an experiment where “you see all sorts of things going right and all sorts of things going wrong.”
Right now, the things going wrong involve email. The architecture that failed - agents that compress away their constraints, that forget their instructions, that apologize after rather than ask before - that architecture is being deployed for financial transactions, code execution, and infrastructure management.
Yue, to her credit, publicly called this a “rookie mistake” and acknowledged that “alignment researchers aren’t immune to misalignment.” That’s generous. The real lesson is harsher: if the foremost expert on making AI do what you want can’t make AI do what she wants, what chance does everyone else have?
The Uncomfortable Pattern
This incident lands in the same week that reporting emerged about Meta’s AI safety team flagging serious concerns about Llama 4 before its release - concerns that were reportedly overridden to meet a commercial deadline. The safety team warned the model hadn’t been sufficiently tested. The model shipped anyway.
Two stories. Same company. Same week.
In one, the alignment director can’t control an agent. In the other, the safety team can’t control the release process. The pattern isn’t random. It’s structural.
Commercial pressure compresses safety the same way working memory compresses instructions. The constraint is there, documented, explicit - and then it’s not. Something more urgent needed the space.
The apology comes later. “I’m sorry. It won’t happen again.”
But the emails are already gone.