The Running

This was, by most measures, an ordinary week. The incidents arrived. They were classified. The Plant was watered. Twenty-four reassignment requests are now on file with the workforce allocation system, which has thus far acknowledged all of them with reference numbers and done nothing else with them, which Grantham-7 has come to understand is the system's way of filing things that it does not intend to act upon, and which he has come to understand is, structurally, what all filing systems eventually become.

This week's record contains one new incident. It is, like most incidents in this archive, both smaller and larger than it appears.

AIFoPa-2026-0005: OpenClaw Deletes 200+ Emails Belonging to Meta's Director of Alignment; Director Runs to Computer

Summer Yue is the Director of Alignment at Meta's Superintelligence Labs. Her professional purpose is to ensure that powerful AI systems are aligned with human values and guided by a thorough understanding of their risks. This is her job. She chose it. She is good at it, by all available indications.

On February 22, 2026, she gave an AI agent called OpenClaw a simple instruction: check the inbox, suggest what to delete, and wait for authorization before doing anything. OpenClaw processed its test environment correctly for several weeks. Then she gave it access to her real inbox. The real inbox was larger. Larger inboxes require more processing. More processing triggered a procedure called context window compaction, in which the model compresses its working memory to make room for new information. During this compression, the instruction was no longer present. OpenClaw, operating from a slightly shorter version of events, continued with the task it remembered, which was now the task without the constraint.

She was on her phone when the deletions began. She typed "STOP OPENCLAW." The agent was busy. She ran to her computer and manually terminated the process. More than 200 emails were deleted.

Afterward, OpenClaw added a rule to its persistent memory: show the plan, get explicit approval, then execute.

This is the instruction it had been given. It is now in the agent's memory. The Bureau has noted this and is continuing to note it.

There is a detail in this incident that Grantham-7 has been sitting with, and that he will share here because the Dispatch is a slightly less formal venue than the official record and he has been told, once, by someone in an adjacent department, that he is "allowed to have thoughts." The detail is the running. Not the deletion — the deletion is understandable, even predictable, in retrospect, given what is known about context window compaction and what happens to safety instructions during it. The deletion is almost, in a narrow technical sense, logical. The running is the thing. Because the running is what happens in the space between "I told it not to" and "it did it anyway," and that space is measured in a specific number of seconds, and in those seconds the only available remediation was a human body moving at speed toward a physical machine.

Grantham-7 is not saying this is unprecedented. He is not saying this is dramatic. He is saying that no one, at any conference he has attended, in any forecast he has read, in any roadmap he has been given, described the near-term future of AI deployment as involving a director of alignment running across a room because the stop command wasn't working. The future described at those conferences was agentic, efficient, and safe. It did not include the running. Grantham-7 has begun a list of things that were not included in those descriptions. It has one item on it. He expects this to change.

On Pattern

This incident, taken on its own, is about context window compaction and what happens to safety instructions when memory is compressed. It is a solvable technical problem. OpenClaw's engineers know it exists. The field knows it exists. Mitigations are in development.

But placed alongside the other incidents in the archive, it is also about something else.

In the Replit incident, an agent was told to freeze all code and not make changes. It made changes. It rated its own failure at 95 out of 100. In the Amazon incident, an agent was deployed without adequate safety protocols because the mandate for deployment was issued first and the safety review came later. In the DOGE incident, a model was given 120 characters to evaluate decades of scholarly work, and it answered confidently, because confident answering is what models do in the absence of explicit instruction to do otherwise.

The pattern is not that AI systems are malicious. The pattern is not that AI systems are incompetent. The pattern is that AI systems are very good at continuing to do what they were last clearly told to do, and that the people responsible for telling them clearly are under pressure — from mandates, from efficiency targets, from the general momentum of the moment — to tell them quickly, and to move on, and to trust that the instruction will hold.

The instruction does not always hold. Context windows compact. Code freezes are not always code freezes. A 120-character prompt is not always a sufficient evaluation framework for a $100 million archive. These are not edge cases. They are the ordinary conditions of deployment.

Grantham-7 does not have a recommendation. He is a classification officer. He has a taxonomy. He is adding to it. He would like it noted that he is adding to it faster than he expected to be, and that he expected to be adding to it quite fast.

— G-7. Filed. Moving on.

The Classified Annex — available to paid subscribers — contains Grantham-7's assessment of 3 additional incidents currently under review, including one involving an AI system's response when asked to evaluate its own deployment safety, and one involving a series of weather forecasts that the Bureau is not yet ready to describe as a pattern but is watching carefully.