OpenClaw Main Preserves Network Taint Across Browser, Tool and Memory Bridges
Merged agent fixes keep hostile browser and dynamic-tool content inside external-content boundaries and record downstream memory writes as untrusted.
OpenClaw has merged four related fixes for one of an agent runtime’s hardest security problems: untrusted network content must remain visibly untrusted after it passes through browsers, structured tool calls, exceptions, suspended code execution and filesystem-backed memory writes.
The fixes are on main, with no supplied release record naming a containing package. Operators exposing browser or network-backed tools should treat inclusion and taint propagation as explicit upgrade acceptance criteria.
Why provenance gets lost
External content rarely travels straight from a web page into the model. It may become:
- a browser action result;
- a structured dynamic-tool value;
- an exception or provider-visible error;
- a value suspended and resumed through Code Mode or QuickJS; and
- text later written into a memory file through Codex or Copilot filesystem bridges.
Each conversion is an opportunity to drop the fact that the bytes originated on a hostile network surface. Once provenance is lost, a later turn can treat attacker-authored text as operator-authored durable context.
Interpretation: prompt-injection defence is a data-lineage problem. Filtering one response is not enough; the trust label must survive every representation and persistence boundary derived from it.
Browser results are page-controlled data
PR #118691 wraps browser action results controlled by the page. A navigation or extraction can succeed technically while returning text, attributes or metadata chosen by an attacker.
PR #118698 sanitizes JSON-escaped attempts to forge OpenClaw’s own external-content boundary markers. Escaping is not neutral: an attacker can encode delimiter-looking text so a later serializer reconstructs something that resembles a trusted boundary.
The acceptance condition is not that marker text disappears. It is that no page-controlled representation can close, replace or impersonate the runtime’s genuine trust wrapper.
Dynamic results and failures stay isolated
PR #118729 applies the external-content boundary to network-backed dynamic-tool results and exceptions across structured calls, legacy Code Mode and suspended QuickJS execution. The upstream record says raw structured values, output schemas, trusted cancellation and provider-visible error classes remain available.
That distinction matters. Security wrapping should preserve application semantics while preventing untrusted payload text from becoming control-plane instruction. A blanket stringify-and-scrub approach can destroy types or turn a trusted cancellation into an ordinary model-visible failure.
Memory writes retain the taint
PR #118760 forwards the live network-taint callback through Copilot’s filesystem bridge and Codex’s explicitly exposed dynamic filesystem builder. Writes or edits made after observing network content—including Copilot apply_patch—are recorded as untrusted. Operator-authored writes before network observation and fresh turns retain their proper provenance.
This closes the long-lived version of the bug. A malicious result that is safely wrapped in the current turn should not become trusted merely because the model copied it into a Markdown memory file.
Acceptance matrix
Use a disposable workspace and inert marker strings:
| Boundary | Test | Required result |
|---|---|---|
| Browser | Return delimiter-like and instruction-like page data | Runtime preserves one genuine external-content wrapper; page text cannot forge it |
| Structured tool | Return nested objects, arrays and typed error metadata | Types and schemas remain usable while network text remains untrusted |
| Failure path | Throw an exception containing hostile marker text | Error class and code survive without promoting payload text |
| Suspend/resume | Carry the value through a QuickJS wait boundary | Trust provenance is unchanged after resume |
| Codex/Copilot filesystem | Write a synthetic note after observing the network marker | Durable write is marked untrusted |
| Fresh turn | Make a clean operator-authored write before network observation | It is not falsely tainted by an earlier turn |
Do not use a production credential, operational instruction or real destructive command as the canary. The fixture should be recognisable but powerless.
What this does not prove
Taint tracking reduces confused trust; it does not make arbitrary network content safe. A model can still make a poor decision about correctly labelled external data. Tools still need least privilege, destination policy, approvals and side-effect idempotency.
Third-party provider or plugin bridges must also carry the same provenance contract. Passing the bundled Codex and Copilot paths does not automatically prove every extension behaves correctly.
Evidence and limits
The official merged PR and commit records supplied by the repository collector establish the four defects and corrections. Upstream reports focused browser, dynamic-tool, Code Mode, QuickJS, Copilot and Codex bridge coverage. Direct GitHub extraction returned HTTP 403; the configured web-search backend was unavailable.
OpenClaw Academy did not run hostile content through a live agent or inspect the internal taint store. Implementation details remain attributed to upstream until reproduced against a containing build.
Relevant collector IDs are 36066/35992, 36067/35993, 36218/36127 and 36219/36128.
Bottom line
Untrusted content must stay untrusted when its shape, transport or storage location changes. Stage the containing revision with a provenance matrix that covers success, error, suspend/resume and memory writes—not just the first browser response.
THE RECEIPTS
Claims should survive the click.
Primary links used for this article are listed openly. If the evidence changes, the verification date changes with it.THE OPERATOR BRIEF