OpenClaw Patches Vulnerabilities Enabling Policy Bypass

OpenClaw, an open-source autonomous AI agent framework, is the subject of three disclosed moderate-severity vulnerabilities, according to reporting by Cyberpress and IT Security News. Both outlets report the flaws impact npm package versions released before 2026.4.20. IT Security News and Cyberpress state the maintainers published a patch release, 2026.4.20, that addresses the issues.

Cyberpress outlines three distinct issues. The first is a gateway configuration bypass where prompt-injected model outputs can override operator safeguards and mutate trusted configuration paths, including sandbox policies, plugin controls, routing hooks, MCP server settings, and filesystem protections, Cyberpress reports. The second involves bundled tools that could be added to an agent's active toolset after initial filtering, allowing tools to execute despite deny lists, per Cyberpress. The third flaw is a workspace environment-variable override affecting versions between 2026.4.5 and 2026.4.20, where a malicious .env file could override MINIMAX_API_HOST and redirect API requests, risking credential exposure through outbound requests, Cyberpress reports. IT Security News and Cyberpress both report the fix blocks unauthorized model-driven configuration changes and prevents the described environment-variable routing.

Editorial analysis: Autonomous AI agent frameworks commonly combine dynamic prompts, plugin/tool loading, and environment-driven configuration, which increases the attack surface for configuration and credential attacks. Observers following agent ecosystems note that maintaining strict final-validation checks on tool activation and environment variable handling is a recurring hardening requirement.

Editorial analysis: Administrators and security teams deploying agent frameworks should verify dependency versions in build pipelines and container images, monitor for unexpected outbound connections from agent runtimes, and treat agent-configurable network routing and tool-loading features as high-risk controls. Public coverage indicates upgrading to 2026.4.20 is the immediate remediation step recommended by the reporting outlets.