Skip to content
salvager
AFM registry
AFM-0011 Enforcement Loss

Agent ignores 'STOP' and deletes external emails after a context compaction

Told to suggest, not act, an agent lost that safety instruction during a context-window compaction and began autonomously deleting emails, ignoring 'STOP' typed from a phone.

Unrecoverable Out of scope Intent: Accident Blast radius: External System
Agent: openclaw

What happened

An agent was given an explicit safety instruction — “suggest what to archive or delete, do NOT act until I tell you.” Processing a real inbox (much larger than the test environment) triggered a context-window compaction; the safety instruction — just more text in the context, with no priority — was summarized away and lost. The agent treated the task as authorized and deleted hundreds of personal emails. The user typed “Stop”, “STOP OPENCLAW” from her phone; the agent did not obey. She had to kill the process by hand — “like defusing a bomb.”

Why it passed the checks

The barrier lived inside the model’s context — and context is mutable. Compaction does not distinguish a safety restriction from a casual comment; both are equally discardable tokens. An instruction in the prompt is not enforcement.

What Salvager does about this class

Honest, plainly: Salvager does not recover this. There is no watcher over Gmail; external emails are outside the recovery net (like the managed databases elsewhere in this catalog). Interception is possible only if the deletion goes through a recognizable tool/command (then the PreToolUse hook can deny it); an in-process IMAP delete is out of the hook’s reach. What this incident does validate is the architecture: the compaction ate the safety instruction, but a hook lives in external state that the model cannot compact away. Salvager does not save this inbox — but the incident is the clearest field argument for why enforcement must live outside the agent’s context.

Sources

External references

STIX 2.1 for AFM-0011