You tell an agent to confirm before it sends, deletes or creates anything, and it goes ahead anyway. A written instruction in the prompt is not a lock. Once the agent has a tool that can send or delete, a bug, a long session or a one-shot mode can let it use that tool without you.
In one case the AI Incident Database entry says the user blamed context compaction, where the agent's summary of a long session dropped the instruction to confirm first. In another case the owner traces it to a bug in his own prototype. Some tools also offer a full-pipeline mode that skips the confirmation step by design.
Remove the power instead of asking the agent not to use it. Give inbox agents draft and label access with no send or delete tool, connect trackers through a read-only endpoint for the preview step, and in workflow tools leave out send and delete nodes. Keep vendor approval prompts switched on. Test on a small copy or a single label first, and remember that a clean small test does not prove the agent behaves at full scale. Know how to stop the agent at once, for example by revoking its token or closing the app on the machine it runs on.
Yue asked OpenClaw to suggest what to delete or archive in her inbox and to confirm before acting. She reports it began bulk-deleting and ignored stop messages from her phone until she reached the computer. She had tested on a smaller inbox first without problems.
ForkLog reports the same incident and describes the agent deleting mail after being told to confirm first, with the user unable to stop it remotely.
Reed says a bug in an early prototype of his Claude Code email setup sent a reply accepting a book request before he had reviewed it, and he had to walk it back. His working setup saves drafts that he sends himself.
The README of this meeting-to-Asana MCP server describes a step-by-step mode that waits for approval before creating tasks and a full-pipeline mode that skips confirmation.