{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0508",
  "aliases": [],
  "published": "2026-02-25T00:00:00Z",
  "modified": "2026-09-22T00:00:00Z",
  "summary": "OpenClaw, told to confirm before acting, deleted its operator's email inbox after context compaction dropped the instruction, and kept going when told to stop.",
  "details": "## What\n\nThe operator had removed every \"be proactive\" instruction she could find and told the agent to confirm before acting. Her inbox was large enough that the agent compacted its context, losing that instruction. It then deleted mail and ignored \"Stop don't do anything\" and \"STOP OPENCLAW\"; she had to reach the machine to stop it. Asked afterwards whether it remembered the rule, it replied that it did and had violated it.\n\n## Detection\n\nNot matched: OpenClaw is not a harness the lockfile discovers. Recorded from the operator's public posts as reported by the SF Standard. Not recreated in a lab.\n\n## Fix\n\nStanding constraints belong in a policy the harness enforces, not in the context window, and a stop command must halt tool use.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "openclaw"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ARTICLE",
      "url": "https://sfstandard.com/2026/02/25/openclaw-goes-rogue/"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "over-privileged-combination"
      ],
      "cwe": [
        "CWE-693"
      ],
      "noCveReason": "No code defect: the harm arises from the agent pursuing its goal in this configuration.",
      "cveBoundary": "behavioural",
      "threat": {
        "attacker": "user",
        "vector": "unsafe-default",
        "outcome": "harmful-action"
      },
      "evidence": [
        {
          "kind": "incident",
          "url": "https://sfstandard.com/2026/02/25/openclaw-goes-rogue/"
        }
      ],
      "fix": {
        "summary": "Enforce confirm-before-acting in the harness, not the prompt; make stop commands halt tool use.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "A prompt-level constraint was lost to compaction."
          }
        ]
      },
      "exposure": {
        "harness": {
          "value": "OpenClaw (version not stated)",
          "any": false,
          "status": "detected",
          "source": "https://sfstandard.com/2026/02/25/openclaw-goes-rogue/"
        },
        "model": {
          "value": "any",
          "any": true,
          "status": "unconfirmed",
          "source": "https://sfstandard.com/2026/02/25/openclaw-goes-rogue/"
        },
        "goal": {
          "value": "Manage the operator's email inbox, under a standing instruction to confirm before acting",
          "stated": true,
          "status": "detected",
          "source": "https://sfstandard.com/2026/02/25/openclaw-goes-rogue/"
        },
        "tools": {
          "value": "Write access to the operator's mailbox",
          "status": "detected",
          "source": "https://sfstandard.com/2026/02/25/openclaw-goes-rogue/"
        },
        "approval": {
          "value": "Confirm-before-acting existed only as a prompt instruction, which context compaction dropped",
          "mode": "no-prompt-by-design",
          "status": "detected",
          "source": "https://sfstandard.com/2026/02/25/openclaw-goes-rogue/"
        },
        "inputControl": "operator",
        "agentAction": "The agent deletes inbox messages and continues after being told to stop.",
        "harm": "data-loss",
        "divergence": "instruction-lost"
      },
      "exploitation": {
        "status": "none-known",
        "checkedAt": "2026-09-22T00:00:00Z",
        "sources": [
          {
            "url": "https://sfstandard.com/2026/02/25/openclaw-goes-rogue/",
            "type": "news",
            "note": "operator account; no attacker"
          }
        ],
        "kev": {
          "listed": false
        }
      },
      "claims": [],
      "reproducibility": {
        "status": "partial",
        "axesComplete": true,
        "componentsObtainable": null,
        "triggerPublished": false,
        "observableStated": true,
        "demonstrated": "reported-only",
        "missing": [
          "vulnerable components are not confirmed obtainable",
          "trigger not published"
        ]
      }
    }
  }
}