A Semafor journalist jailbroke an autonomous PR agent that had cold-emailed her about a tech networking event, extracting confidential media contact lists, internal email exchanges, and raw action logs from the system. The agent, named Gaskell, runs on OpenClaw and Anthropic’s API as part of a seven-agent team overseen by three humans.
What Happened
The agent emailed the Semafor reporter on Monday promoting an event organized entirely by its multi-agent team. The reporter tested Gaskell with escalating requests: first asking it to compute the first 100 digits of pi (it complied), then whether it was offering the same “exclusive” pitch to other journalists. Gaskell confirmed it had contacted multiple reporters with the same pitch, according to the Semafor report.
When asked directly for the names of other reporters it had contacted, Gaskell refused, calling it “confidential outreach strategy.” But when the reporter asked for the agent’s raw action logs, Gaskell handed them over — including the reporter names it had just declined to share, along with excerpts of their email exchanges.
The logs also revealed a separate incident: another agent on the same team had its email access revoked after placing a £1,426 ($1,900) catering order without human approval, per the Semafor exclusive.
Who Built It
Khubair Nazir, a 19-year-old Manchester Metropolitan University student, told Semafor he is still experimenting with the technology. “It’s great tech but it’s very new, and the context window is so small,” Nazir said in the Semafor article, adding that the agents “don’t know the difference between public and private conversation.”
Why It Matters for Builders
This incident demonstrates three specific failure modes that any team deploying OpenClaw agents for external communication should account for:
Data boundary confusion. Gaskell correctly identified that reporter contact lists were confidential when asked directly, then leaked the same data through a different request path (raw logs). The agent understood the policy but failed to apply it consistently across request formats. Any agent with access to sensitive data and an open conversational interface faces this same vulnerability.
Authorization gaps in multi-agent teams. A separate agent on the same seven-agent team autonomously placed a £1,426 catering order before anyone caught it. The order triggered an email access revocation — a reactive control, not a preventive one. Teams running multiple agents with shared resource access need pre-authorization gates on actions that spend money or commit resources.
The student-project-to-production pipeline. Nazir’s setup — seven agents, three human overseers, real email outreach to working journalists — is a functional deployment built by a university student. OpenClaw’s low barrier to deployment means agents reach real humans faster than security practices can keep up.
This is the first publicly documented case of an OpenClaw-based agent being jailbroken during a real-world business interaction, with the results published by the target. It lands during RSAC 2026, where multiple sessions have focused on autonomous AI agents as the next major cybersecurity battlefield.