OpenClaw fixes 23 confirmed vulnerabilities after Trail of Bits audit

OpenClaw disclosed on September 21st that a Trail of Bits security audit found 23 confirmed vulnerabilities in the local AI agent's permissions and data-handling machinery, including two High-severity and 16 Medium-severity flaws, with no Critical findings. Trail of Bits submitted 27 private repository advisories and three hardening pull requests through OpenAI's Patch the Planet initiative; OpenClaw said every actionable issue has been repaired and all three hardening pull requests merged, with fixes shipped on the main branch and in the 2026.8.1 and 2026.7.33 LTS stable releases. The audit's central finding was that an agent's permissions did not always survive the handoff from one stage of work to the next, a pattern OpenClaw said matters because agent work frequently branches into subagents, delayed jobs and cached operations.

OpenClaw fixes 23 confirmed vulnerabilities after Trail of Bits audit The local AI agent shipped fixes for two high-severity and 16 medium-severity flaws, many involving permissions lost between tasks. By RuntimeWire Staff https://runtimewire.com/author/runtimewire-staff · Published Primary source: OpenClaw Newsroom https://openclaw.ai/blog/openclaw-trail-of-bits-engagement-recap/ Why it matters OpenClaw gives agents access to messages, memory, files and host tools. Finding 23 confirmed flaws shows how easily authorization can break as agent work branches, moves or continues in the background. Peter Steinberger @steipete https://x.com/steipete?ref=runtimewire built OpenClaw https://openclaw.ai/?ref=runtimewire to give people an AI agent that runs on their own computers and acts across messages, memory, files and other tools. On September 21st, OpenClaw disclosed the results https://openclaw.ai/blog/openclaw-trail-of-bits-engagement-recap/?ref=runtimewire of a broad security audit that found 23 confirmed vulnerabilities in the permissions and data-handling machinery supporting that access. Trail of Bits https://www.trailofbits.com/?ref=runtimewire submitted 27 private repository advisories and three separate hardening pull requests through OpenAI's Patch the Planet initiative https://openai.com/index/patch-the-planet/?ref=runtimewire . OpenClaw's recap https://openclaw.ai/blog/openclaw-trail-of-bits-engagement-recap/?ref=runtimewire says 24 reports received severity ratings: two High, 16 Medium and six Low, with no Critical findings. One of those reports covered a vulnerability that had already been fixed before submission, leaving 23 classified as confirmed vulnerabilities. The GitHub security advisories https://github.com/openclaw/openclaw/security/advisories?ref=runtimewire page lists the project's published advisories. OpenClaw said every actionable issue has been repaired, while all three hardening pull requests were merged. The fixes are on the main branch and shipped in the 2026.8.1 and 2026.7.33 LTS stable releases, according to OpenClaw's recap. The OpenClaw release history https://github.com/openclaw/openclaw/releases?ref=runtimewire provides the project's published version records. The severity totals and remediation status come from OpenClaw's account of the engagement. Some advisories were closed without publication because the flaws were fixed before reaching a stable release. OpenClaw's recap groups the findings by recurring engineering pattern rather than presenting an advisory-by-advisory technical report. The permissions failed between steps The audit's central finding was that an agent's permissions did not always survive the handoff from one stage of work to the next. A request could enter OpenClaw with restricted access and then initiate another task that no longer carried those restrictions. In some cases, OpenClaw needed to propagate the original permissions. In others, the follow-on operation should never have received tool access. The recap uses filename generation as an example: producing a name does not require access to an operator's tools. The pattern is particularly important for AI agents because their work frequently branches. A user request can launch subagents, delayed jobs, cached operations or calls into messaging and file-handling components. Every handoff creates another place where the original authorization decision can become detached from the work it was meant to limit. Trail of Bits also found cases where OpenClaw checked one identifier and later acted on another. OpenClaw supports older names for some identities and features so that existing configurations keep working. A policy could evaluate one alias while the runtime resolved and used another. OpenClaw changed that flow so the security decision applies to the canonical identity or feature name that the runtime will actually use. Other findings involved a gap between the resource OpenClaw approved and the resource eventually consumed. One check inspected only part of an archive before the full archive was extracted. Another approved a file path that subsequently changed. The repairs bind approval to the final file, identity or operation, with another check required if the target changes. Long-running agents created a second authorization problem OpenClaw's persistent and background work made one-time permission checks insufficient. The recap describes a run that began while memory access was enabled. If an operator disabled memory access before the run finished, the agent could continue reading memory because the permission had been checked only at startup. OpenClaw moved those checks closer to execution so tools consult the current configuration whenever they act. That detail cuts to the security problem behind persistent agents. Traditional software often handles a request within a short, bounded transaction. An agent may keep working after the user closes a chat, changes a setting or revokes access. Authorization therefore has to remain attached to the task throughout its lifetime. OpenClaw's published security policy https://github.com/openclaw/openclaw/blob/main/SECURITY.md?file=SECURITY.md&ref=runtimewire defines the software as local-first infrastructure for trusted operators rather than a shared service designed to isolate adversarial tenants. The three unrated defense-in-depth findings did not cross a boundary recognized by that model. The 23 confirmed vulnerabilities did. Local control still carries a security bill Steinberger founded PSPDFKit, the PDF software business, in 2011 and ran it for 13 years. Fortune reported https://fortune.com/2026/02/19/openclaw-who-is-peter-steinberger-openai-sam-altman-anthropic-moltbook/?ref=runtimewire that he returned to coding after burnout and created the first OpenClaw prototype because he was annoyed that the assistant he wanted did not exist. That founding impulse shaped OpenClaw's pitch: users can run the agent on their own hardware, choose models and keep persistent context under their control. RuntimeWire's August breakdown of OpenClaw 2.0 https://runtimewire.com/article/full-breakdown-openclaw-2-0-vs-grok-bot-and-chatgpt-work found that the same flexibility leaves operators responsible for the hardware, configuration and security burden that hosted rivals absorb. The Trail of Bits findings put numbers around that burden. Local deployment can reduce dependence on a vendor's cloud, but the agent still needs exact rules governing messages, memory, credentials, archives, paths and tool calls. A permission model that works at the front door can fail several steps into an agent run. OpenClaw has also grown beyond the single-machine assistant Steinberger initially created. Its persistent sessions, background work and agent handoffs create authorization state that must remain valid as work continues across sessions and time. Steinberger is turning a solo project into security infrastructure Steinberger works at OpenAI while retaining technical stewardship of OpenClaw. The project is now stewarded by the OpenClaw Foundation https://openclaw.ai/blog/introducing-openclaw-foundation?ref=runtimewire , a US 501 c 3 nonprofit with a full-time team and maintainers from several companies. The foundation's people page https://www.openclaw.org/people?ref=runtimewire lists 3,324 contributors who have shipped code into the repository. OpenAI occupies several positions around that structure. OpenAI employs Steinberger, supports the foundation, supplies inference and Codex Security, and launched the initiative that funded this Trail of Bits engagement. Trail of Bits supplied the human review layer: researchers used Codex-assisted workflows to search for bugs and prepare fixes, then manually validated findings before submitting them to OpenClaw. OpenAI launched Patch the Planet on June 22nd to place AI-assisted security research in front of experienced reviewers before maintainers receive reports. OpenAI has acknowledged that its models still generate enough false positives to increase the burden on open-source maintainers without that filtering. For OpenClaw, the program produced a manageable set of confirmed issues, patches and tests rather than another automated scanner queue. Steinberger said the first functional version of OpenClaw took one hour to build in a Lex Fridman interview https://lexfridman.com/?p=6411&ref=runtimewire . Later versions evolved into an agent with access to messaging, files and computer tools. The audit shows the engineering work required after that expansion: permissions must follow every branch of an agent's work, revocations must reach tasks already running, and security checks must cover the exact resource used at execution time. OpenClaw has repaired the reported failures. Its next security test will be whether those rules remain enforceable as Steinberger and the foundation add more ways for agents to run longer, move between machines and act without a user watching each step.