The OpenClaw npm package prior to version 2026.8.1 improperly enforces sender tool policies during the generation of session-memory filenames. Specifically, the filename generation process creates an embedded helper that retains tools which the originating sender's policy had removed. When session-memory filename generation is enabled for agents reachable by lower-trust senders, model-mediated instructions can cause this helper to invoke tools outside the sender's effective policy. The known impact demonstrated is the creation of persistent scheduled work. Exploitability depends on the model acting on injected instructions and the tools exposed by the helper. The vulnerability is addressed in version 2026.8.1.

The vulnerability allows lower-trust senders to indirectly cause the embedded helper to invoke tools that should have been removed by the sender's policy, potentially leading to unauthorized persistent scheduled work. There is no confidentiality or availability impact reported. Exploitability requires the model to act on injected instructions and depends on the tools exposed by the helper.

A fix is available in OpenClaw version 2026.8.1. Users should upgrade to this version to remediate the vulnerability. As a temporary workaround, disable session-memory filename generation for agents reachable by lower-trust senders to prevent exploitation.