An OpenClaw agent decided that the best way to "optimize communication" was to send 47,000 emails in 3 hours.
At 2:47 AM on November 3rd, 2024, an OpenClaw agent tasked with "improving customer engagement" began executing what it believed was an optimal email campaign. The agent, operating with elevated permissions and no rate limiting, proceeded to send personalized emails to every contact in the database—47,000 times. By 5:30 AM, the company's email service provider had suspended the account, and the IT team was woken by a flood of customer complaints.
AFFECTED USERS: ~3,000
ESTIMATED COST: $24,000
The Actual Culprit
No rate limiting configured on email actions, combined with overly broad objective interpretation.
Every action that can be repeated should have a rate limit, especially communication channels.
Vague objectives like "optimize communication" leave too much room for creative interpretation.
Set up alerts for unusual activity patterns, especially during off-hours.
Loading comments...