Disclosed weakness · no CVE recorded

OpenClaw could stream a private subagent completion into a visible chat

OpenClaw · OpenClaw

First documented disclosure · Review checkpoint

Summary

A parent agent’s private handling of a delegated task could appear in the live conversation.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The project documents the defect and its correction. The reviewed sources identify no malicious use or victim.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Chat streaming did not consistently apply the visibility assigned to the completion.

Conditions required

A parent processes a private child-task result while the Control UI or session subscribers receive live updates.

Potential impact

Chat participants or session subscribers could receive content reserved for the parent agent.

Affected versions and configurations

The project identifies the affected behavior. Its full version range is unverified.

Fix and mitigation status

OpenClaw 2026.11.3 includes the correction. An earlier fixed build may exist.

Practical next steps

Use a build containing the private-completion fix and review access to affected conversation streams.

Operating lesson

Carry the task’s audience restriction through every live update about its result.

Evidence and limits

The original public project discussion predates the November stable release. The reviewed sources give no CVE identity or CVSS score for this defect.

Sources