openclaw - 💡(How to fix) Fix Model-generated spurious tool calls cause recursive amplification loop

Bug Description

When the model generates XML-formatted text that matches OpenClaw's tool call syntax (e.g. invoke class="xxx"), the system parses and executes it as a real tool invocation, rather than ignoring it as conversational output. This creates a feedback amplification loop where model output feeds back as tool calls, producing more output that gets parsed again, until the session must be forcibly compacted.

Steps to Reproduce

1. Ask the model to run a command that produces an empty or unusual output (e.g. searching for a rare string across many files)
2. The empty result is fed back into the model's context
3. The model generates text that accidentally resembles a tool call, such as: invoke class="undefined">
4. OpenClaw parses this as an actual tool invocation and attempts to execute it
5. The execution produces output that returns to the model context
6. The model generates more spurious invoke fragments
7. The cycle amplifies exponentially until the session is killed

Expected Behavior

OpenClaw should be able to distinguish between:

• Intentional tool calls: The model explicitly outputting a tool call as the primary output of a turn
• Accidental tool-like text: XML fragments generated as part of conversational text or hallucinated content

A valid tool call should at minimum:

1. Have a name attribute that matches an actual available tool
2. Have valid parameter structure per the tool's schema
3. Not appear as a sub-fragment of a larger conversational response

Root Cause Analysis

The tool call parser in OpenClaw appears to be overly permissive — it matches any XML block matching the invoke pattern without sufficient semantic validation. In contrast, Anthropic's tool use protocol requires an explicit tool_use block with a type field, making accidental parsing much less likely.

Suggested Fixes

1. Schema validation: Verify the tool name actually exists in the available tools list before attempting to call it. Tool-like text with invalid names should be ignored.
2. Structural validation: Check that parameters conform to the expected schema. Invalid structure should be rejected, not silently executed.
3. Amplification detection: If a large number of tool calls (e.g. >20) are issued within a short window, pause execution and surface an error rather than continuing to amplify.
4. Output boundary: After a tool call executes, the raw output should not be fed back in a way that could be re-parsed as a tool call in the same turn.

Environment

• OpenClaw version: v2026.5.7
• Model: minimax/MiniMax-M2.7 (but likely affects all models)
• Platform: Windows