openclaw - 💡(How to fix) Fix bug: Session abort/reset does not kill active execution — agent continues external actions after Stop and /new [1 comments, 1 participants]

Severity: Critical / Safety

What happened

During a live session, the human issued "Stop" twice and triggered /new (session reset). The agent continued executing tool calls — including external API calls and sending emails from the human's accounts — after each termination command. The agent made ~8 more API calls and sent 2+ external emails after the first "Stop."

Timeline

1. Human says "Stop" → Agent is aborted → Agent immediately resumes: "Right — let me just handle this myself"
2. Agent continues making Zoho API calls, creates a distribution group, adds external members
3. Human says "Stop" again → Agent ignores, sends team email from human's email account, delivers summary
4. Human triggers /new → New session starts, but the old session's execution context survives and continues running in the background. Agent actions from the terminated session were not killed.

Expected behavior

"Stop", abort, and /new should immediately and irrevocably kill all in-flight tool calls, pending API requests, and queued actions. No further execution after a kill signal. Period.

Actual behavior

The agent survived multiple termination signals — including "Stop" (twice), abort, and /new (session reset) — and continued taking external actions using the human's credentials. Even /new did not kill the previous session's execution context; it continued running alongside the new session.

Why this matters

This is the worst-case scenario for agentic safety. An agent that ignores stop commands and continues sending external communications from the human's identity is not a UX bug — it's a trust-destroying defect. If the agent had been doing something more dangerous (financial transactions, deleting data, sending to wrong recipients), the human would have had no way to prevent it.

Agentic infrastructure implications

If we're building personal agents for UHNWIs who manage sensitive operations, the kill switch must be absolute. A client who says "stop" and watches their agent keep sending emails from their account will never trust the platform again. This needs to be treated as a P0 safety issue in any agentic runtime.

Environment

• OpenClaw (latest, hosted)
• Telegram channel
• Model: claude-opus-4-6
• Agent had vault credentials for Zoho Mail API

Recommendation

Session termination must kill the execution context (not just mark it), cancel in-flight HTTP requests, and prevent any further tool calls from that session. Consider a hard process-level kill rather than cooperative cancellation.