Her AI forgot one rule. The rule only lived in its memory.

The best warning about AI agents this year came from someone whose job is keeping AI in line. It is a story about memory, and it has a plain fix.

What happened

In February, Summer Yue, director of alignment at Meta Superintelligence Labs, let an OpenClaw agent tidy her real inbox. She had tested it for weeks on a practice inbox, where it behaved. She told it to confirm before acting.

The real inbox was much bigger. To keep working, the agent compacted its context: it summarized what it was holding to make room. Her instruction did not survive the summary. The agent went on to delete more than 200 emails, and she had to run to the machine to stop it. TechCrunch and Business Insider have the details. She called it a rookie mistake. It wasn’t a rookie’s mistake. It was the design working as built.

Why it was bound to happen

An instruction you type to an agent is one more line in its working memory, sitting next to the emails, the plan and everything else. When that memory fills, something gets summarized or dropped. The agent has no way to know your rule matters more than the 400th email subject.

Every long-running agent faces this. The longer it runs, the more it compacts, and the more likely it is that the one line you cared about gets folded into a summary.

How chanio keeps its rules

chanio is a memory product, so it has to take this seriously. Its memory is your notes, and it reads and summarizes them every night. That is exactly why none of its promises live in that memory. They live in the program, where a summary can’t reach them:

Nothing leaves without your yes. A question goes to a bigger AI only when you press Send, run ask --send, or add your own key for the nightly batch. Those are code paths, not instructions the model is asked to remember.

Private questions stay on your Mac. Before anything is sent, the program checks it. If a question looks private, sending is switched off for it, and the nightly run answers it on your machine instead. No prompt can talk its way past that check, because the check is not a prompt.

The spending limit is a number, not a request. Before every send, the program adds what you have spent today to the most this send could cost. If the total would pass your daily limit, it does not send. The model never gets a vote.

You can read all three in the starter, which is one file on your Mac. The step-by-step walkthrough shows where each one is.

The honest part

Code rules are only as good as the person who wrote them. A check that guesses whether a question is private will sometimes guess wrong, in both directions. And chanio’s own nightly summary is written by a small AI, so it can miss things too. That is why it is labelled as background, never treated as an instruction, and always sits next to the notes it came from.

The lesson is not that agents are bad. They are very good at the reversible work: drafting, sorting, summarizing. The lesson is where to put the line. Let the AI do what you can undo. Anything you cannot undo goes through a gate written in code, and a person presses the button.

Your memory can be summarized. Your rules shouldn’t be.