Executive brief
OpenClaw is a framework used to build AI agents with chat interfaces. The vulnerability allows an authorized user in a sandboxed session to bypass sandbox restrictions and initialize host-level ACP (agent control plane) sessions using the /acp spawn command. An attacker could break out of the sandbox environment and gain unauthorized access to host-side runtime capabilities when ACP is enabled.
Technical details
This is a sandbox escape vulnerability caused by inconsistent access control. The ACP spawn handler in src/auto-reply/reply/commands-acp/lifecycle.ts called initializeSession() without first applying the same runtime-policy guard that exists in the direct ACP spawn path in src/agents/acp-spawn.ts. The /acp spawn slash-command allowed sandboxed requesters to initialize ACP sessions (which run on the host, not in the sandbox), whereas the sessions_spawn() API was already blocked. The vulnerability requires an already-authorized sender in a sandboxed session to execute the /acp spawn command when ACP is enabled with a backend available. The fix introduced a shared ACP runtime-policy guard that is now checked before any ACP backend initialization.
Affected products
- OpenClaw OpenClaw <= 2026.3.2
Timeline
- 2026-03-09: disclosed
- 2026-03-07: patched: Fix commit 61000b8e4ded919ca1a825d4700db4cb3fdc56e3
- 2026-03-09: advisory: GHSA-9q36-67vc-rrwg published