OpenClaw Fixes 23 Confirmed Vulnerabilities Found in Trail of Bits Audit

OpenClaw says it has fixed and released patches for every actionable issue found in a broad security audit, but the findings point to a difficult agent-security problem: a permission check at the start of a task may not protect the work that follows. The Trail of Bits review found flaws involving lost permissions, changing targets, and access that could persist after an operator turned a feature off.

OpenClaw disclosed the results on September 21 of an audit performed by Trail of Bits through OpenAI’s Patch the Planet initiative. The review covered core permissions and the handling of user data across OpenClaw’s features. OpenClaw said the engagement produced 27 private repository advisories and three separate hardening pull requests; it merged all three hardening changes.

The vulnerabilities were about continuity, not one broken gate

The recurring problem was not simply whether OpenClaw asked for permission. It was whether those limits remained attached as a request branched into later work. OpenClaw said a request with restricted access could launch follow-on work that no longer carried the original limits. In other cases, the follow-on task did not need access at all; the company offered filename generation as an example of work that should not receive tool access.

Four patterns behind the fixes

• Permissions could be lost as work moved between steps or follow-on tasks.
• A security policy could check an alias while the system later used a different identity or feature name.
• A check could approve a resource before the final file, path, or operation changed.
• A running task could retain access after an operator changed the relevant setting.

Revoking access has to reach work already underway

One finding involved a long-running agent task that began while memory access was enabled. If an operator disabled that access before the task ended, the run could continue reading memory because the setting had been checked only when the work started. OpenClaw said it moved some checks closer to the moment tools act, so they consult the current configuration instead.

That distinction is consequential for software that can continue work after an initial request. OpenClaw’s stated lesson is that approval must apply to the exact identity, file, or action eventually used, with another check if that target changes. The company also said that tests need to reach the actual security boundary, rather than stop at the helper function where a defect first appears.

AI-assisted research, with human review

Trail of Bits used Codex-assisted workflows to look for issues and develop fixes, then manually reviewed findings before submitting them, OpenClaw said. OpenClaw reviewed the reports against its trust model and release history, then coordinated private disclosure while testing accepted repairs. The company classified three remaining reports as defense-in-depth findings without severity ratings because they did not cross a documented trust boundary.

OpenClaw said every actionable issue has been repaired on its main branch and shipped in stable releases 2026.8.1 and 2026.7.33 LTS. The disclosure closes this audit engagement, but it leaves a practical design test for agent software: permissions cannot merely be granted correctly at the front door; they must remain correct throughout the work.