Openclaw cli: OpenClaw inter-session prompts could be treated as direct user instructions

OpenClaw CLI versions before 2026.2.13 persist inter-session messages sent via sessions_send as user role messages without provenance metadata, causing instruction-provenance confusion. This allows delegated or internal sessions to inject instructions into other sessions that appear as if they originated from external users. The fix introduces a structured input provenance model with a kind field (including inter_session) to mark routed prompts distinctly. This provenance is persisted on user messages, and transcript readers and memory helpers are updated to respect this provenance, preventing inter-session prompts from being treated as external user input. The fix also adds explicit in-memory markers for inter-session messages and regression tests to ensure correctness.

The vulnerability can lead to unintended privileged behavior in workflows that rely solely on the user role as an authority signal, due to confusion between external user input and internal inter-session instructions. This may allow internal or delegated sessions to inject instructions that are treated as if they were from an external user, potentially bypassing intended security boundaries.

A fix is available in OpenClaw CLI version 2026.2.13 and later. Users should upgrade to this version to ensure proper input provenance handling. If immediate upgrade is not possible, disable or restrict the sessions_send functionality and avoid relying solely on the user role as an authority boundary; instead, implement provenance-aware checks in orchestration logic.