OpenClaw versions prior to 2026.4.20 have a vulnerability that allows local attackers with agent access to bypass configured tool restrictions. This flaw enables attackers to append restricted tools to the effective tool set after policy filtering, circumventing multiple security policies including profile policies, allow/deny lists, owner-only restrictions, sandbox policies, and subagent policies.