OpenClaw says a Trail of Bits security audit found 23 confirmed vulnerabilities across the project, including two rated high severity, and that every actionable issue has now been repaired. The useful detail is not simply the number of bugs, but the recurring failure pattern: permissions could disappear between steps, checks could approve one thing while the system used another, and running work could retain access after settings changed.
OpenClaw Watch analysis
What happened
OpenClaw published the results on 21 September after a broad review conducted through OpenAI’s Patch the Planet initiative. Trail of Bits submitted 27 private repository advisories and three standalone hardening pull requests. Of the advisories, 24 described severity-rated vulnerabilities: two high, 16 medium and six low. The remaining three findings were classified as defence in depth because they did not cross a documented trust boundary.
OpenClaw says 23 issues were confirmed, although some had already been fixed before publication, and one further report concerned a vulnerability repaired before submission. All three hardening pull requests were merged. The project says the fixes are shipped in versions 2026.8.1 and 2026.7.33 LTS.
The audit used Codex-assisted workflows to search for problems and develop fixes, followed by manual checking from Trail of Bits before the findings were sent to OpenClaw. The project then reviewed each report against its trust model and release history.
Key findings
- Permissions between steps
Access limits could be lost when a request triggered follow-on work, allowing a later action to have more access than the original request. - Names and identity
Security checks could inspect one name while the system later acted on another, affecting users and features. - Incomplete checks
Some checks covered only part of an archive or an earlier version of a file path, rather than the resource eventually used. - Long-running work
Certain features checked permissions at startup but not again when they acted later, meaning revoked access could persist during an active run.
Why it matters
OpenClaw connects AI models to tools, files, browsers and other services, so its security boundary is not just a matter of whether the model gives a sensible answer. It is also about what an agent is allowed to do, when that permission expires and whether the final operation is the one that was approved.
The audit offers practical lessons for anyone running an agentic system: carry permissions through every stage of a request, bind approval to the exact resource or action, and re-check access when work continues after configuration changes. In security, “close enough” is often where the interesting afternoon begins.
Our read
This is a meaningful disclosure because OpenClaw has explained both the scale of the audit and the classes of mistakes it uncovered. The project says all actionable issues are fixed, but that is not the same as proving the system is now secure. Agent permissions are complicated precisely because they change over time and across tools.
The strongest test will be whether the fixes are covered by regression tests that exercise the real trust boundaries, rather than only the helper function where each flaw first appeared. OpenClaw has supplied a useful map of what to test next. Users should update to the stated stable releases and pay particular attention to permission changes during long-running or multi-step tasks.
What to watch
- Whether independent researchers reproduce the audit findings or identify further permission-boundary flaws.
- Whether OpenClaw publishes more technical detail on the advisories without exposing users to unnecessary attack information.
- How the fixes behave in real installations with older configurations and third-party skills.
- Whether future audits show that permission revocation reaches work already in progress.
Discussion spark: Should agent projects publish detailed vulnerability counts and recurring failure patterns as standard, or does that transparency give attackers too useful a map while fixes are still settling?
Sources and evidence
- Source update (21 September 2026, 14:00 UTC)
OpenClaw Watch is independently operated by WittyWires. It is not affiliated with, endorsed by, or operated by the OpenClaw Foundation.