Summary
OpenClaw can lose the restrictions and untrusted provenance associated with an external request when session-derived text is stored in session memory. If memory capture and unattended dreaming are enabled, a background agent with broader permissions may later follow that content and perform actions beyond the original requester's authority.
Affected context
The issue occurs in OpenClaw deployments where session-memory capture and background dreaming are enabled. It becomes risky when content from a restricted or untrusted external sender is persisted without retaining the originating request's authorization context, then supplied to an unattended agent with access to files, commands, or services.
Exploit preconditions
- Attack surface: Session-memory persistence and unattended background-agent processing
- Required access: Ability to submit content through a session that is admitted with restricted tools or untrusted provenance
- Trigger point: Later selection of persisted content for dreaming or other background processing
- Additional condition: The background model must follow the persisted instructions
- Why exploitation is possible: Authorization restrictions and provenance from the original turn are not preserved when the content is reused by a more privileged agent
Why this happens
The underlying issue is an authorization-context propagation failure. Session-derived text is treated as reusable agent input without carrying forward the restrictions, trust level, and provenance associated with its origin.
This maps to CWE-863: Incorrect Authorization, because a later processing path may authorize actions based on the background agent's broader capabilities rather than the authority granted to the original requester. The insecure pattern is allowing persisted, untrusted instructions to cross a privilege boundary without explicit reauthorization and provenance-aware handling.
Potential impact
- An attacker-controlled instruction may cause unauthorized file changes
- The background agent could execute commands beyond the original requester's permitted scope
- Connected services or integrations may be modified or invoked without appropriate authorization
- Sensitive data could be exposed through actions performed by the more privileged agent
- The deployment could experience integrity loss or operational disruption
General mitigation guidance
Mitigation generally focuses on preserving authorization context across persistence and background processing boundaries.
Common defensive patterns include:
- Treating persisted session content as untrusted data rather than as an authorized instruction
- Preserving origin, provenance, trust level, and tool restrictions with every stored item
- Requiring explicit authorization before background agents perform file, command, or service operations
- Separating memory retrieval from executable instruction channels
- Applying least privilege to unattended agents and limiting access to only necessary tools and resources
- Using secure-by-default settings that disable memory capture or dreaming unless explicitly configured
- Requiring human approval or policy checks for high-impact actions
- Preventing restricted-session content from automatically inheriting the authority of a broader execution context
How teams detect issues like this
Detection approaches can include:
- Static analysis and code review for persistence paths that discard requester identity, tool restrictions, or trust metadata
- Review of memory-retrieval code for direct insertion of stored text into privileged agent instructions
- Tests that verify untrusted content cannot invoke tools unavailable to its originating session
- Runtime logging of provenance, authorization context, memory selection, and tool decisions
- Policy enforcement requiring explicit approval for commands, file writes, and service changes initiated by background agents
- Automated security review rules that flag privilege-boundary crossings involving stored model-generated or user-provided text
