A broad audit, with defined numbers
OpenClaw has published the results of a broad security audit conducted by Trail of Bits through OpenAI’s Patch the Planet initiative. The OpenClaw announcement, dated 21 September, reports 27 private repository advisories and three standalone hardening pull requests. Of the advisories, 24 were severity-rated and 23 were classified as confirmed vulnerabilities. OpenClaw says every actionable issue was repaired and all three hardening changes were merged.
The rated findings comprised no critical issues, two high, 16 medium and six low. Three other findings were described as defence in depth and not assigned a severity because they did not cross a documented trust boundary. These categories are useful context, but they do not mean the software has no remaining security risk. An audit examines a particular code base and scope at a particular time.
OpenClaw says some reports were closed without publication because the issue was fixed before reaching a stable release. That distinction matters to operators assessing exposure: a flaw in development code may not have affected a deployed stable version. Equally, users need to know which stable release contains the repairs. The project says the fixes are in versions 2026.8.1 and 2026.7.33 LTS.
Where permissions were lost
One recurring problem was that a request could begin with limited access but hand work to another component without carrying the restriction forward. A follow-on task might then have more tools than it needed. OpenClaw gives the example of a filename generator, which has no reason to possess tools at all. The principle is straightforward: delegated work should inherit the original boundary or have a narrower one, never gain access because context was dropped.
Another class of findings concerned names. Legacy aliases meant the same user or feature could be described in more than one way. A security check might inspect one name while the system later used another. The fix is to resolve the actual identity or feature before applying policy, so the check and the action refer to the same thing.
The audit also found cases where a check and the final operation did not match. A partial archive inspection could miss content later extracted, or a file path could change after approval. A safe design binds approval to the exact object and action that will be used. If either changes, the system needs to check again.
Long-running agents create a timing problem
Some permissions were checked when an agent began work but not when it acted later. If an operator disabled memory access while a run was already in progress, the run could continue reading until it ended. OpenClaw says it moved checks closer to use and now checks the current setting whenever a tool acts. The example illustrates a wider issue for agents: a decision made at start-up may become stale while work continues.
For administrators, updating the software is the first step, but configuration remains important. Review which agents can read memory, access files, invoke tools or communicate with external services. Test that removing a permission takes effect during an active run as well as on the next run. If the system cannot immediately revoke access, that limitation should be reflected in operating procedures.
The Patch the Planet engagement used Codex-assisted security research with human review, according to OpenClaw. That combination found issues and helped develop fixes, but the human verification is significant. Automated analysis can suggest a vulnerability or patch; deciding whether it crosses a trust boundary and whether the fix holds requires review against the actual product behaviour.
How users should interpret the result
The audit offers unusually concrete information about failure patterns in an agent platform. It does not amount to a blanket certification or a promise that every skill or integration is safe. Operators should read the project’s advisories and release notes, update to a repaired stable version and keep third-party skills subject to separate scrutiny.
A practical review should trace a user request through every hand-off: which identity is checked, what files can be read, which tools can act, and whether an approval still applies at the point of use. Test aliases and changed paths, not only straightforward cases. These exercises turn the audit’s lessons into local assurance rather than treating a completed audit as the end of security work.
The news is both the number of confirmed findings and the stated repair of actionable issues. More importantly, OpenClaw’s account identifies a common architectural risk for AI agents: permissions must remain attached to the request across time and delegation. That is relevant well beyond one open-source project, especially as organisations let assistants undertake longer tasks with access to valuable data.
Teams using older installations should first establish which version is actually running, including any pinned LTS branch, then compare it with the repaired releases. They should avoid assuming that a container image or package was refreshed merely because a repository merged a fix. Verifying the deployed version closes the gap between published remediation and protection in practice.