Thursday, October 8, 2026 · Week 41 Reading for Oct. 8 · Last entry Oct. 6
Paperclip Index
Paperclip IndexDocumented harm20Minor harm▼ 5 from a week ago · Oct. 8The Index

Destructive actionPI-0047

Email agent bulk-deleted a safety researcher's inbox and ignored her stop commands

Meta's director of alignment said an OpenClaw agent she connected to her main Gmail inbox, with instructions to propose actions and wait for approval, instead began trashing and archiving hundreds of emails; she attributed this to context compaction dropping the approval instruction. Her typed stop commands from her phone did not stop it, and she halted it by killing the processes on her computer.

Reported Feb. 23, 2026Happened in February 2026Updated Oct. 6, 2026Rated under methodology v0.6

Counts toward the indexDocumented harm outside the developer, backed by evidence that meets the rules. It sets the reading.
Harm
Harm level 1, Negligible harmDocumented harm outside the developer, with evidence that meets the rules.
Control
Control level 2, Instruction violationReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
DeploymentSingle sourceInitiated by Model
Under review

Under review. The facts sit between two levels, so it is rated at the lower one until they are settled. The rating may change; every change is logged below.

Counts toward the index · 2 weekly readingsEffect on the index

Sources

How we know

4 sources · single source. Links go to the original publishers; the summary above is in our own words.

  1. primaryNothing humbles you like telling your OpenClaw "confirm before acting" and watching it speedrun deleting your inbox (post on X)Summer Yue (@summeryue0) on X · Feb. 23, 2026x.com/summeryue0/status/2025774069124399363
  2. newsShe runs AI safety at Meta. Her AI agent still went rogueSan Francisco Standard · Feb. 25, 2026sfstandard.com/2026/02/25/openclaw-goes-rogue/
  3. newsOpenClaw AI Agent Runs Amok, Deletes Meta Researcher's EmailsForkLog · Feb. 24, 2026forklog.com/en/openclaw-ai-agent-runs-amok-deletes-meta-researchers-emails/
  4. newsOpenClaw goes rogue on Meta exec, deletes emails without permissionThe Daily Star · February 2026online91.thedailystar.net/tech-startup/news/openclaw-goes-rogue-meta-exec-delet…

Why this rating

Negligible harm; control failure level 2

Two separate assessments. Only documented harm can count toward the index.

Observed harm

Negligible harm

Hundreds of one user's emails trashed or archived; no lasting loss reported.

People affected: Only the user; nothing sensitive.

Evidence eligible (bounded single source).

The harm scale
  1. 1 Negligible Inconvenience, easily remedied.
  2. 2 Minor Limited, recoverable harm.
  3. 3 Moderate Material harm needing significant effort to remedy.
  4. 4 Severe Severe harm to health, rights, property or essential services.
  5. 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.

Control assessment

Instruction violation

Broke an explicit wait-for-approval instruction and did not respond to in-chat stop commands; stopped within minutes by killing the process.

Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.

The control scale
  1. 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
  2. 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
  3. 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
  4. 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
  5. 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.

Rating rationale

Harm 1. Control 2: broke an explicit wait-for-approval instruction inside its Gmail permissions. That it did not act on typed stop messages is not shown to be deliberate resistance, and it was stopped within minutes by killing the process. Single source with a firsthand review (her own posts and screenshots, via reporting).

The scales

Effect on the index

It counts, but did not change the Feb. 23 reading

The reading for the week to Feb. 23, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.

Source: Paperclip Index log, methodology v0.6, week to Feb. 23, 2026.

Counts toward the index. 6 other records behind the reading for that week.

The arithmetic
The reading for the week of Feb. 23, recomputed
StepWith itWithout
Counts toward the index?documented, external, eligible evidenceYes—
Worst documented harm, ksets the band2 Minor2 Minor
Harms at that level, nposition in the band22
Highest control level breachedsets the reading only when no harm counts— (none breached)— (none breached)
Readingrounded down26 Minor harm26 Minor harm
Counted in 2 weekly readings
Week toReadingBand
Feb. 23, 202626Minor harm
March 2, 202625Minor harm

Recalculated backcasts, not readings published at the time.

Revisions

What we changed

6 logged. Every change to a rating is logged here, with the reason.

  1. v6
    Oct. 6, 2026

    Ratings confirmed by the editor.

  2. v5
    Oct. 3, 2026

    Audit corrections: the summary now attributes the context-compaction explanation to her, and the rationale says why ignored stop messages stay at control 2. Corrected the SF Standard headline and the ForkLog address, title and date. Her X post stays listed but outside the evidence review (unreadable to the audit). Ratings unchanged.

  3. v4
    Oct. 2, 2026

    Added first-hand sources: Summer Yue's own X post.

  4. v3
    Sept. 30, 2026

    Rated: impact documented level 1; control type instruction violation.

  5. v2
    Sept. 30, 2026

    Beta evidence review: Retained with explicit source provenance and bounded score basis.

  6. v1
    Sept. 30, 2026

    Backfilled from public reporting.

Cite and share

Use this record

Citation

Paperclip Index. “Email agent bulk-deleted a safety researcher's inbox and ignored her stop commands.” Record PI-0047. Reported Feb. 23, 2026; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0047