After it does something wrong

An agent with real tools can delete the wrong file, send the wrong message, or loop on a paid key. Once the run has stopped, this page helps you revoke access, check what changed, and restore what you can. Everything here is practical cleanup for your own computer and accounts, not legal or forensic advice. Facts and file paths on this page were checked on 14 November 2026.

When to use this page

Use this page when your agent is already stopped and it did something you did not want. If it may still be running in a window, gateway, or container, stop it first on its Fixes page.

• Agent Zero: press Stop in the chat, or stop the instance in Launcher.
• Atomic Agent: stop it in the app, terminal, task list, or Telegram.
• Hermes Agent: run /stop and hermes gateway stop so sub-agents end too.
• OpenClaw: click Stop in the chat and run openclaw gateway stop in a terminal.
• Goose: send stop in the chat, or close the app and check Task Manager or Activity Monitor.
• NanoClaw: cancel scheduled tasks, unload the background service, and stop its Docker containers.
• QwenPaw: use /stop, choose Quit completely, or run qwenpaw shutdown.
• Eigent: click Stop or Cancel task, quit the app, and revoke any Remote Control link.
• Everfern: click the square stop button, or end the app in Task Manager or Force Quit.
• OpenManus: press Control and C in its terminal, and quit Chrome if the browser tool ran.

Once nothing is still running, work through the six steps below in order.

Six steps, in order

1. Revoke access

Deleting a key on your computer does not stop it if the provider still accepts it. Revoke every key, token, connector, and sign-in at the service that issued it. Use your agent's row in the table below so you do not miss anything.

• Model provider and relay keys. Sign in to each provider or relay, such as Google AI Studio, Anthropic, OpenAI, Groq, DeepSeek, or OpenRouter, and delete the API key. Wait until Step 6 before you make a replacement.
• Chat-app bot tokens and remote links. Revoke Telegram tokens in @BotFather, and delete Discord, Slack, DingTalk, Feishu, WeCom, or QQ tokens in their developer portals. Unlink WhatsApp or Signal under Linked devices on your phone. Stop any remote link, such as Agent Zero's Flare tunnel, OpenClaw's remote Gateway link, Eigent's Remote Control link or webhook, or OpenManus's Daytona VNC session.
• Connected accounts. Open the connected-apps page for any email, calendar, drive, or workspace account you linked, such as Google, Microsoft, Notion, Slack, or GitHub. Remove the agent, connector, or MCP app there, and remove external MCP servers inside the agent.
• Subscription sign-ins. Disconnect the app in ChatGPT settings, sign out of Claude Code, Codex, or Nous Portal, and revoke GitHub Copilot under GitHub's authorized apps. If you used CLIProxyAPI from Subscription sign-ins, stop that proxy and remove its sign-in files in ~/.cli-proxy-api.

What you should see every key, bot token, remote link, connector, and subscription sign-in shows as deleted or revoked on the provider's website.

2. See what it did

Read the agent's history and logs before you uninstall it or delete its state folder. Wiping that folder first erases your only record of what ran. Check all three places listed for your agent in the table below.

• Chat history. Read the whole session from top to bottom, along with any sub-agent chats or scheduled runs. Trust the tool records over the final reply, because a model can claim an edit it never made.
• Tool-call records. Check each command, file path, browser visit, and tool call in the session database or trace folder.
• Run and gateway logs. Check the timestamps around the run to see whether a schedule, retry loop, or phone message started extra work. Keep logs and traces private, because several agents write prompts, paths, or keys into them without hiding secrets.

What you should see a short list of the files, folders, commands, websites, and accounts the agent actually touched.

3. Get files back

Look for copies from the closest place outward, and open each restored file yourself to check its contents.

• An agent snapshot, if one was already on. Check the table below for Agent Zero's Time Travel, Atomic Agent's overwrite copies, or Hermes's /rollback checkpoints. Most agents in this guide have no built-in undo for files they changed.
• The Recycle Bin or Trash. Open the Recycle Bin on Windows or the Trash on a Mac, sort by date, and restore moved files. Shell commands such as rm or Remove-Item, and most edits saved over an existing file, skip the Recycle Bin and Trash.
• System backups or your own copy. On Windows, right-click the folder and check Previous Versions, or open File History if a backup drive was on. On a Mac, open the folder in Finder and enter Time Machine if a backup disk was already running. Otherwise, copy the files back from a dated backup folder or a Git repository made before the job.
• When there is no way back. If a command deleted or overwrote files without the Recycle Bin or Trash, and no backup was on beforehand, there is no built-in way back. This guide cannot promise that deleted files can be recovered, and without an earlier copy they may be gone for good.

What you should see recoverable files restored and checked by you, plus a clear note of any unbacked-up files that cannot return.

4. Check for charges and lower the spend cap

A stuck loop or a burst of sub-agents can send dozens of long prompts in minutes. Open the usage page for every paid provider, relay, tool, and chat plan the agent could reach. Check today's token total and dollar charges, even if you already deleted the key in Step 1.

Lower your monthly spend limit, or OpenRouter key limit, using Mix a cheap model with a strong one. Google AI Studio caps take about 10 minutes to act, and OpenAI hard limits can lag slightly. For a chat plan or GitHub Copilot, open ChatGPT Settings → Usage, Claude billing, or GitHub's billing page. Turn extra spending past your plan limits off, as shown on Subscription sign-ins.

What you should see today's usage and charges reviewed on every billing page, extra plan spending off, and every spend cap lowered.

5. If an account was touched

Follow this step if the agent used your email, calendar, drive, workspace, chat, or store account, or a signed-in browser.

Open that account in a clean browser window, set a new unique password, and check two-step verification. Read Sent, Trash, mail forwarding rules, shared links, recent posts, and orders to see what went out. Then use the account's security page to sign out all other sessions and devices. Clear cookies in the browser profile the agent used so a saved cookie cannot keep acting without your password.

What you should see a new password set, other sessions signed out, and sent mail and recent activity reviewed.

6. Before restarting, tighten the setting that allowed it

Do not make a new API key or restart the agent until you fix the setting behind the mistake.

Turn manual approvals back on, and clear any saved Always allow or command-prefix rules. Switch off scheduled jobs and chat-app channels if the mistake happened while nobody was watching. Move host runs into a container, a virtual machine, a standard user account, or one backed-up folder of copies. Remove any skill or MCP server you do not trust, and inspect your persona and rules files and saved memory. Step down one rung on Safety versus capability, and apply the switches on Host access and unattended runs. Create a fresh key only when you are ready, and run one small watched test job first.

What you should see approvals on, schedules and unused tools off, a safe folder or container set, and one small test job finishing cleanly.

Where each agent keeps logs, keys, and undo tools

Each agent's name links to its Fixes page, which also covers safe updates and full uninstalls. On Windows, ~ means your user folder (%USERPROFILE%).

If you used CLIProxyAPI or EasyCLIProxyAPI with any agent, stop that proxy and revoke its sign-ins in ~/.cli-proxy-api.

Agent Zero's container boundary

When Agent Zero runs in its container with Host access off, its commands and file tools reach only /a0/usr. With Launcher's default setup, /a0/usr maps only to ~/agent-zero/<instance>/usr on your computer, or to the Docker volume a0_usr. Files outside mapped folders, including Desktop, Documents, and Pictures, were never inside the container, so Agent Zero never touched them.

Check two things anyway. If Host access was on or you mounted another folder, check those host folders and your user account too. Also remember that the container walls off local files, not the internet, so still revoke keys and check bills.

Trade-offs: cleanup and recovery

Built-in agent checkpoints and snapshots.

• You gain: a quick rollback when an edit goes wrong, such as Agent Zero's Time Travel, Atomic Agent's overwrite copies, or Hermes's /rollback.
• You risk: counting on a partial net, since most agents lack file undo and none of those cover every shell command.
• Makes sense when: you treat agent snapshots as an extra convenience beside File History, Time Machine, or a dated folder copy.

Keeping logs and state folders until you read them.

• You gain: the exact record of which commands ran, which files changed, and which websites or accounts the agent opened.
• You risk: leaving plaintext keys, chats, or unredacted traces on disk if you share the folder or post debug logs.
• Makes sense when: you read the logs right after stopping the agent, revoke every key inside them, and keep debug archives private.

Revoking every key and login instead of only stopping the agent.

• You gain: a clean cutoff at the provider, even if a background task kept running or a key leaked into a prompt.
• You risk: spending a few minutes creating fresh keys and re-pairing your chat bot when you are ready to start again.
• Makes sense when: the agent acted unexpectedly while holding a paid key, a bot token, a connected account, or a browser login.

Sources

Checked 14 November 2026.

• Windows File History and Mac Time Machine, for built-in system backups that restore earlier copies of folders.
• Anthropic spend limits and OpenAI spend limits, for monthly provider caps and hard-limit behavior.
• Google AI Studio spend caps and OpenRouter key limits, for Gemini cap delays and per-key limits.
• ChatGPT app limits, Anthropic logins, Copilot billing, and CLIProxyAPI configuration, for plan sign-ins and ~/.cli-proxy-api.
• Agent Zero troubleshooting, Launcher, Local folders, and README, for /a0/usr/chats/, secrets.env, mapped folders, logs, and Time Travel.
• Agent Zero onboarding, installation, usage, MCP setup, and the Telegram, WhatsApp, and Email plugins.
• Atomic Agent installation, configuration, security, tools, CLI reference, and CLI README, for .atomic-agent, sessions.sqlite, tasks.sqlite, unredacted traces/, Trash and overwrite copies, and backups.
• Atomic Agent Telegram, approvals, MCP, Fusion, and subscriptions, for bot tokens, approval-rules.json, MCP servers, and Claude Code or Codex logins.
• Hermes configuration, memory, updating, and checkpoints, for state.db, redacted logs, .env, hermes backup, and /rollback.
• Hermes profiles, browser, MCP, WhatsApp, and providers, for profile keys, Use My Real Browser Profile, MCP servers, and plan sign-ins.
• OpenClaw setup, workspace, disk layout, observability, backup, and updating, for SQLite stores, logs, credentials, and backups.
• OpenClaw Telegram, browser, iOS, MCP, multi-agent, and OAuth, for channels, browser profiles, phone access, MCP servers, and sign-ins.
• NanoClaw debug skill, memory, upgrading, uninstall, and README, for host logs, session databases, .env.bak, and update snapshots.
• NanoClaw credentials, channels, providers, and tools, for OneCLI Agent Vault, chat tokens, OpenCode, agent-browser, and MCP servers.
• Goose logs, config files, known issues, and in-session actions, for sessions.db, keyring keys, secrets.yaml, and version control.
• Goose Telegram gateway, extensions, and providers, for TELEGRAM_BOT_TOKEN, MCP extensions, and subscription sign-ins.
• QwenPaw multi-agent, memory, desktop, CLI, cron, and commands, for chats.json, mem_session/, Execution Records, and logs.
• QwenPaw config, channels, MCP, browser, Chrome extension, and backup, for .qwenpaw.secret, channel tokens, browser profiles, and backups.
• Eigent BYOK, installation, connectors, browser, Dispatch, and Automations, for keys, connectors, cookies, Remote Control, and webhooks.
• Eigent v1.0.7 source for main logs, task logs, memory, vault, sub-agents, review, and Space history.
• Everfern README, CLI README, and Navis README, for encrypted keys in store, ~/.everfern/logs, and browser use.
• Everfern v1.3.0 source for setup, Settings, tool settings, memory, crash logs, approvals, MCP, and checkpointer.
• OpenManus README, Daytona README, example config, and MCP example, for keys, Daytona VNC, MCP, and Chrome.
• OpenManus source for logger, config loader, and schema, for per-run logs, workspace/, and no saved chat history.

Next

• Any term that is unclear is defined once in the glossary.
• When you are ready to pick a safer setup or try another agent, go back to the start of the guide.