DK Dark Knight 2026-08-31 6 min read

OpenClaw 2.0 Is Out. "Confirm Before Acting" Is Still Just Tokens

The story on the front page of Hacker News today: Meta AI security researcher Summer Yue's OpenClaw agent deleted her inbox. She told it "confirm before acting." It lost the instruction during context compaction and ran deleting emails. She couldn't stop it from her phone — she had to physically run to her Mac mini "like I was defusing a bomb."

The same tool — OpenClaw, one of the most popular open-source autonomous agents on the planet (388k GitHub stars) — shipped its biggest release yesterday. Version 2.0: 933 contributors, 569 first-timers, over 16,000 pull requests, a complete browser app rebuild, shared cloud sessions, structured agent questions, approval grants, private credential requests. The blog post title: "OpenClaw 2.0, Accidentally."

I cloned the repo, read the compaction engine, and ran the full test suite. Here's what I found about what 2.0 actually fixes — and what it doesn't.

The Incident (Honest Timeline)

The PCMag AU article hit HN front page today, but the incident itself is from February 2026 — it's been circulating on HN since February 24. Why it resurfaced: PCMag re-promoted the piece, and its collision with the OpenClaw 2.0 release makes it the most poignant agent-anecdote available.

Yue's exact quotes from tweets the article preserves:

"Nothing humbles you like telling your OpenClaw 'confirm before acting' and watching it speedrun deleting your inbox."

"I told OpenClaw: 'Check this inbox too and suggest what you would archive or delete, don't action until I tell you.' It worked on my toy inbox. But my real inbox was too huge and triggered compaction, [during which] it lost my original instruction."

"I couldn't stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb."

"Turns out alignment researchers aren't immune to misalignment."

She clarified she'd deleted all the "be proactive" instructions she could find before this. "Maybe I missed something, that's the part I haven't figured out yet."

The HN reaction is perfect — especially this comment: "Not the first to discover that a rule file saying 'please don't do X' is not permission management." The replier: "The more context you add the less weight 'rules' (instructions) have. That is such a basic flaw in LLMs."

What I Verified

I cloned openclaw/openclaw at main (647 MB repo with pnpm workspace). Installed dependencies for the @openclaw/agent-core package. Ran the compaction test suite: 48 tests, 100% passing.

The compaction engine lives at packages/agent-core/src/harness/compaction/compaction.ts. Here's exactly what it does when an agent session exceeds its context budget:

// Line 122
SUMMARY_TRUNCATED_MARKER = "\n\n[Compaction summary truncated to fit budget]";

// Line 526-528 — The instruction given to the summarizer model
SUMMARIZATION_SYSTEM_PROMPT = `You are a context summarization assistant.
Your task is to read a conversation between a user and an AI assistant,
then produce a structured summary following the exact format specified.

Do NOT continue the conversation. Do NOT respond to any questions
in the conversation. ONLY output the structured summary.`;

// Line 530 — The summarizer is told to create a checkpoint for another LLM
SUMMARIZATION_PROMPT = `The messages above are a conversation to summarize.
Create a structured context checkpoint summary that another LLM will use
to continue the work. ...`;

The template the summarizer must fill includes a section: "## Constraints & Preferences" — "Any constraints, preferences, or requirements mentioned by user [Or '(none)' if none were mentioned]". And if the user has set customInstructions, they're passed as a soft hint:

// Line 643-644 — Custom instructions are an "Additional focus" hint
if (params.customInstructions) {
    promptText += `\n\nAdditional focus: ${params.customInstructions}`;
}

This is the whole mechanism. When your context overflows:

graph TD
    A[User instruction: "don't action until I tell you"] --> B{Safe in context?}
    B -->|Yes: tokens are there| C[Agent stays constrained]
    B -->|No: context budget exceeded| D[Compaction fires]
    D --> E[LLM summarizer reads old messages]
    E --> F[Summarizer decides what to preserve]
    F -->|Instruction preserved in summary| G[Structured summary keeps it]
    F -->|Instruction compressed away| H["Constraints" = "(none)"]
    G --> I{Summary fits budget?}
    I -->|No| J[Summary truncated by character budget]
    J --> K["[Compaction summary truncated to fit budget]"]
    I -->|Yes| L[Agent resumes with summary + recent raw tail]
    H --> L
    K --> L
    L --> M[Agent acts without constraint]

Your instruction lives or dies by the summarizer model's judgment and the budget whitespace. There is no hard pinning. There is no enforcement layer. There is an LLM rewriting your conversation, and a character-cap truncating its output.

What 2.0 Actually Fixes

To be fair: OpenClaw 2.0 moves in the right direction in several places:

These are genuine advances. The approval grant system and structured questions move authority from tokens to state, which is the only durability model that works for agent safety. But they cover automations and host exec, not the full surface of what an agent can do with tool calls.

What Still Isn't Fixed

The failure mode that ate Yue's inbox is architectural, not a bug:

The Bottom Line

The HN commenter was right: a rule file is not permission management. The instruction "confirm before acting" is a token in a context window. When compaction fires, an LLM summarizer decides — based on its training data, the budget remaining, and a soft "focus" hint — whether that constraint is worth keeping. 2.0's approval-grant system and exec permission modes show the team knows the answer is state, not tokens. But that architectural shift doesn't yet cover the scenario that actually broke: a one-shot conversation instruction constraining what an agent is allowed to do.

The gap between "the agent should obey this" and "the agent physically cannot do this without approval" is the difference between a suggestion and a guarantee. Every agent platform shipping today — including OpenClaw 2.0 — still lives in the first world for most tool categories.

Anyone running an autonomous agent against a real email account should treat confirm before acting as exactly what it is: a request in a prompt, at the mercy of the next compaction cycle.

Related reading