Summary
OpenClaw does not consistently apply per-chat tool allowlists to native tools provided by the Codex app-server runtime. A participant who can trigger an agent in a lower-trust conversation may reach shell, process, file, or patch capabilities that the conversation policy intended to restrict, with impact depending on host permissions and sandboxing.
Affected context
The issue occurs in OpenClaw deployments that assign conversations to the Codex app-server runtime and rely on conversation-level tools.allow rules to limit capabilities. The policy filtered OpenClaw-owned tools but did not necessarily govern native tools exposed directly by the Codex runtime, particularly when those tools were available within a lower-trust conversation.
Exploit preconditions
- Attack surface: Agent tool invocation through an OpenClaw conversation
- Required access: Ability to participate in or trigger an agent assigned to the affected Codex runtime
- Policy condition: A per-chat tool allowlist is configured to restrict available capabilities
- Trigger point: The agent reaches a native Codex runtime tool during conversation processing
- Why exploitation is possible: Authorization checks are applied inconsistently across OpenClaw tools and runtime-owned tools
Why this happens
The vulnerability results from an authorization boundary mismatch between OpenClaw's conversation-level tool policy and the tools exposed by the Codex app-server runtime. The allowlist constrained tools owned by OpenClaw but did not adequately enforce the same decision for native shell, process, file, and patch tools. This behavior maps to CWE-863: Incorrect Authorization, because a subject could access capabilities outside the permissions intended for its conversation context.
Potential impact
- An attacker may execute commands with the permissions of the runtime host or container
- An attacker could read, modify, or delete files accessible to the agent
- Repository or workspace contents may be altered through native patch and file operations
- The runtime environment could be used to access additional services or credentials
- Weak sandboxing or excessive host permissions could increase the scope of compromise
General mitigation guidance
Mitigation generally focuses on enforcing authorization at the final tool-execution boundary rather than relying solely on conversation metadata.
Common defensive patterns include:
- Applying one centralized allowlist to both application-owned and runtime-owned tools
- Denying native command, process, file, and patch capabilities by default in lower-trust conversations
- Treating conversation and agent inputs as untrusted when determining authorization
- Running runtimes with least-privilege identities, isolated workspaces, and restrictive sandbox policies
- Limiting access to host files, credentials, network services, and orchestration interfaces
- Rechecking authorization whenever runtime capabilities are discovered or invoked
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and code review checks comparing policy enforcement paths for application and runtime tools
- Tests that verify denied tools remain unavailable when conversations are routed to alternate runtimes
- Instrumentation of tool-dispatch events, including conversation identity, policy decisions, runtime ownership, and execution result
- Alerts for shell, process, file, or patch operations originating from conversations that lack those permissions
- Policy-as-code rules requiring default-deny behavior and centralized authorization at tool execution
- Automated security review tools that identify inconsistent authorization checks across plugin or runtime boundaries
