Executive brief
OpenClaw is an AI orchestration platform that executes code and models in sandboxed environments. A configuration option called tools.fs.workspaceOnly restricts file access to a designated workspace directory for security hardening. When this setting was enabled, the native image auto-loading feature for vision-capable AI models failed to enforce the restriction, allowing attackers to reference and load images from outside the workspace (such as /agent/secret.png), bypassing the intended security control.
Technical details
This is a privilege escalation / access control bypass (CWE-284, CWE-200) in OpenClaw's native prompt image ingestion functions (detectAndLoadPromptImages and loadImageFromRef). The functions resolved and read sandbox paths but did not apply the same workspace-root assertion enforced by file tools when tools.fs.workspaceOnly was configured. The vulnerability requires all of: sandbox mode enabled, tools.fs.workspaceOnly=true set, an out-of-workspace mount path reachable, and a vision-capable model active. An attacker could reference out-of-workspace image files in prompt text, causing sensitive image bytes to be loaded and sent to the vision model, exposing data meant to be outside the workspace. The fix was released in version 2026.2.24.
Affected products
- OpenClaw openclaw all versions up to and including 2026.2.23
Timeline
- 2026-02-25: disclosed
- 2026-02-25: patched: Version 2026.2.24 published on npm with fix