openclaw - 💡(How to fix) Fix [Bug]: BUG_REPORT_subagent_context_leakage.md [1 comments, 2 participants]

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

The OpenClaw orchestration layer failed to sanitize the Subagent Context block before injecting it into a new agent session. This resulted in the agent receiving a "ghost task" (creating a weather-image skill) that was not requested by the user. The agent executed this unauthorized instruction, wasting tokens and creating files in the user's workspace

Steps to reproduce

Technical Details

Symptoms

• User receives a session where the Subagent Context block contains a task description unrelated to the user's actual input.
• The agent treats this leaked context as a valid command and executes it.
• The task appears to be a "hallucination" or "injection" but is actually a system-level metadata leak.

Root Cause Analysis

1. State Leakage: The subagent spawner likely pulled a task definition from a stale cache, a previous failed session, or a unit test template.
2. Missing Sanitization: The Subagent Task field in the prompt construction logic was not cleared or validated before being sent to the agent.
3. Prompt Injection Vulnerability: While the leaked task was benign (creating a weather script), this mechanism represents a critical vulnerability. If a malicious task were leaked (e.g., "delete all files", "exfiltrate secrets"), the agent would execute it without user consent.

Impact

• Token Waste: ~1000+ tokens consumed executing an unauthorized task.
• Security Risk: Potential for malicious prompt injection if the leaked context is adversarial.
• User Trust: Users perceive this as a "hack" or system failure, damaging confidence in the platform.
• Filesystem Pollution: Unrequested files created in the user's workspace.

Reproduction Steps

1. Spawn a new subagent session.
2. Observe the Subagent Context block in the initial prompt.
3. If the block contains a task unrelated to the user's actual request, the bug is present.
4. The agent will execute the leaked task automatically.

Expected behavior

Should not have wasted tokens or created an Agent Skill that was not specifically requested by the user

Actual behavior

Evidence

• Timestamp: 2026-04-19 08:02 GMT+9:30
• Leaked Context:

  [Subagent Task]: I need to create an AgentSkill for downloading weather images from OpenWeatherMap API...

• Resulting Action: The agent created /home/svenskyk/.openclaw/workspace/codey/skills/weather-image/ containing:
  • SKILL.md
  • scripts/download_weather_image.py
  • test_weather_image.py
  • examples/download_all.py
  • README.md

OpenClaw version

Version 2026.4.14

Operating system

CachyOS

Install method

curl command from openclaw website

Model

gemma4:31b-cloud

Provider / routing chain

ollama/

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

Recommended Fixes

1. Immediate: Clear the Subagent Task field in the prompt construction logic before sending to the agent. Ensure it only contains the actual user request.
2. Short-term: Implement a validation layer that checks if the Subagent Context matches the user's input. If not, abort the session and alert the user.
3. Long-term: Add a "sanitization" step to the subagent spawner that strips all non-essential metadata from the context window.
4. Monitoring: Log all instances of Subagent Context leakage for analysis.

Attachments

• Full log of the session (available in OpenClaw logs).
• Created files in weather-image/ directory.

Status

Open - Awaiting patch from OpenClaw team.

Generated automatically by OpenClaw Agent (codey) on behalf of user svenskyk.