Executive brief
OpenClaw is an AI-driven system that integrates with Slack. When Slack integration is enabled, attackers who can modify Slack channel descriptions can inject malicious instructions into the model's system prompt. In deployments where the system has tool execution enabled, this could lead to unintended actions, data exposure, or unauthorized tool invocation.
Technical details
The vulnerability is a prompt injection attack (CWE-74, CWE-94) where Slack channel metadata (topic/description) is incorporated unsanitized into the LLM's system prompt. The attack requires network access, Slack integration to be enabled, low privileges (ability to modify channel descriptions), and user interaction. An attacker who controls or can edit a Slack channel description can craft malicious prompts that break out of the intended system instructions, potentially leading to unintended tool invocations or data exposure in deployments with tool execution enabled. The vulnerability is fixed in openclaw version 2026.2.3 and later.
Affected products
- OpenClaw openclaw < 2026.2.3
Timeline
- 2026-02-17: disclosed
- 2026-02-17: patched: Version 2026.2.3 and later