Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: Security Issue: Agent Privacy Isolation Bypass via Direct File Read [1 pull requests, 2 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#70573•Fetched 2026-04-24 05:56:16
View on GitHub
Comments
2
Participants
2
Timeline
7
Reactions
0
Author
iamspark1eiamspark1e
Participants
iamspark1eiamspark1erafiki270rafiki270
Timeline (top)
labeled ×3commented ×2cross-referenced ×2

Agents configured with memorySearch.enabled=false and separate workspace directories can still access other agent's private memory files using the read tool, bypassing all isolation measures.

Root Cause

Agents configured with memorySearch.enabled=false and separate workspace directories can still access other agent's private memory files using the read tool, bypassing all isolation measures.

Fix Action

Temporary Workaround

Document in AGENTS.md/SOUL.md that agents must not read other agent's directories, but this is only a soft constraint and relies on agent compliance.

PR fix notes

PR #70682: fix: add workspaceOnly enforcement to read tool (#70573)

Description (problem / solution / changelog)

Problem

When (the default), the read tool had no sandbox guard and could access any file on the filesystem. This is a privacy issue where agents with separate workspaces (e.g., therapist vs architect) could read each other's private memory files.

Root cause: was wrapping directly without workspace boundary enforcement. The pattern exists for write/edit but was missing for read.

Fix

Added which mirrors the pattern used by and , using to conditionally enforce workspace boundary based on the flag.

Updated to use instead of directly calling .

Added regression tests covering:

  • : current behavior allowed (documented as potentially unsafe)
  • : blocks cross-agent file access, path traversal, parent directory access
  • : still allows reads within workspace

Testing

pnpm vitest run src/agents/pi-tools.workspace-only-false.test.ts src/agents/pi-tools.privacy-isolation.test.ts
PASS src/agents/pi-tools.workspace-only-false.test.ts
PASS src/agents/pi-tools.privacy-isolation.test.ts

Fixes #70573

Changed files

  • extensions/telegram/src/bot-handlers.runtime.ts (modified, +29/-7)
  • src/agents/anthropic-transport-stream.test.ts (modified, +68/-0)
  • src/agents/anthropic-transport-stream.ts (modified, +31/-5)
  • src/agents/pi-embedded-runner/run.incomplete-turn.test.ts (modified, +43/-0)
  • src/agents/pi-embedded-runner/run.ts (modified, +10/-3)
  • src/agents/pi-embedded-runner/run/payloads.test.ts (modified, +32/-0)
  • src/agents/pi-embedded-runner/run/payloads.ts (modified, +3/-2)
  • src/agents/pi-tools.privacy-isolation.test.ts (added, +163/-0)
  • src/agents/pi-tools.read.ts (modified, +79/-0)
  • src/agents/pi-tools.ts (modified, +4/-4)
  • src/agents/pi-tools.workspace-only-false.test.ts (modified, +3/-4)
  • src/agents/session-write-lock.test.ts (modified, +107/-0)
  • src/auto-reply/reply/groups.test.ts (modified, +40/-0)
  • src/auto-reply/reply/groups.ts (modified, +64/-0)
  • src/config/io.ts (modified, +13/-9)
  • src/config/io.write-config.test.ts (modified, +138/-2)
  • src/gateway/server/ws-connection/handshake-auth-helpers.test.ts (modified, +22/-10)
  • src/gateway/server/ws-connection/handshake-auth-helpers.ts (modified, +1/-3)
  • src/media/web-media.test.ts (modified, +22/-0)
  • src/media/web-media.ts (modified, +10/-0)
  • ui/src/ui/controllers/chat.test.ts (modified, +82/-0)
  • ui/src/ui/controllers/chat.ts (modified, +65/-1)

Code Example

read path="~/.openclaw/agents/therapist/MEMORY.md"

---



---

{
  "agents": {
    "list": [{
      "id": "architect",
      "pathPermissions": {
        "allow": ["~/.openclaw/workspace", "~/.openclaw/agents/architect"],
        "block": ["~/.openclaw/agents/therapist"]
      }
    }]
  }
}
RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

Agents configured with memorySearch.enabled=false and separate workspace directories can still access other agent's private memory files using the read tool, bypassing all isolation measures.

Steps to reproduce

  1. Configure therapist with separate workspace
  2. Create MEMORY.md in therapist directory with private content
  3. Ask architect/engineer/secretary agent to read that file
  4. They can access it successfully

Expected behavior

Therapist's MEMORY.md should only be accessible by therapist agent, not by other agents.

Actual behavior

Other agents can directly read therapist's memory file:

read path="~/.openclaw/agents/therapist/MEMORY.md"

This completely bypasses:

  1. memorySearch.enabled=false (only disables vector search, not direct reads)
  2. Separate workspace (only affects Project Context injection, not file permissions)
  3. AGENTS.md isolation rules (text constraints, no enforcement)

OpenClaw version

2026.4.21

Operating system

Debian12

Install method

Official CLI

Model

GLM-5

Provider / routing chain

direct model call

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

  • Privacy leak: Confidential therapy conversations can be accessed by technical agents
  • Trust violation: Users expect therapy content to be private
  • Configuration misleading: memorySearch.enabled=false suggests isolation but doesn't prevent direct access

Additional information

Suggested Fix

Implement agent-level file path allowlists/blocklists:

{
  "agents": {
    "list": [{
      "id": "architect",
      "pathPermissions": {
        "allow": ["~/.openclaw/workspace", "~/.openclaw/agents/architect"],
        "block": ["~/.openclaw/agents/therapist"]
      }
    }]
  }
}

Temporary Workaround

Document in AGENTS.md/SOUL.md that agents must not read other agent's directories, but this is only a soft constraint and relies on agent compliance.

Environment

  • OpenClaw version: 2026.4.21
  • Platform: Linux (Debian)
  • Channel: Feishu

Date

  • Reported: 2026-04-23
  • Reporter: User via agent interaction

extent analysis

TL;DR

Implement agent-level file path allowlists/blocklists to restrict access to sensitive directories.

Guidance

  • Review the suggested fix in the issue, which involves adding pathPermissions to the agent configuration to control access to specific directories.
  • Verify that the memorySearch.enabled=false setting does not affect direct file reads and adjust the configuration accordingly.
  • Consider the temporary workaround of documenting agent constraints in AGENTS.md/SOUL.md, but note that this relies on agent compliance and is not a robust solution.
  • Test the implementation of agent-level file path allowlists/blocklists to ensure that agents can only access authorized directories.

Example

The provided JSON snippet demonstrates how to configure agent-level file path allowlists/blocklists:

{
  "agents": {
    "list": [{
      "id": "architect",
      "pathPermissions": {
        "allow": ["~/.openclaw/workspace", "~/.openclaw/agents/architect"],
        "block": ["~/.openclaw/agents/therapist"]
      }
    }]
  }
}

Notes

The suggested fix requires changes to the agent configuration, and the effectiveness of the temporary workaround depends on agent compliance.

Recommendation

Apply the suggested fix by implementing agent-level file path allowlists/blocklists, as it provides a more robust solution to restrict access to sensitive directories.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Therapist's MEMORY.md should only be accessible by therapist agent, not by other agents.

#api#output truncation#response parsing#generation error#database connection

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Bug]: Security Issue: Agent Privacy Isolation Bypass via Direct File Read [1 pull requests, 2 comments, 2 participants]