OpenClaw's 'Allow Always' Feature Security Flaws and Safer Alternatives
OpenClaw Approval System Vulnerabilities
OpenClaw's approval system asks users "can I do this?" before running commands, with options to approve once or approve always. The "allow always" feature has been identified as a security risk through two recent CVEs.
Specific Security Issues
CVE-2026-29607: The "allow always" approval binds to the wrapper command, not the inner command. If you approve time npm test with "always," the system remembers "always allow time." Later, if the agent (or through prompt injection) runs time rm -rf /, it executes without re-prompting because you approved the wrapper command.
CVE-2026-28460: This vulnerability bypasses the allowlist entirely using shell line-continuation characters. Different technique but same outcome: commands execute without the approval check you thought was protecting you.
Both vulnerabilities are patched in OpenClaw 3.12+, but the deeper issue remains.
The Behavioral Security Problem
Even after patching, the "allow always" mental model trains users to stop paying attention. Initially, users carefully read every approval prompt. By week 3, they're clicking "always" on everything because prompts become annoying and trust builds in the agent. By week 6, users accumulate 20+ "always" rules they couldn't list if asked.
Recommended Alternative Approach
The source author recommends: no "allow always" for anything that modifies files, sends messages, or runs shell commands. Instead, add explicit guardrails in your SOUL.md file:
"for any action that modifies files, sends communications, or executes shell commands: show me exactly what you plan to do and wait for my explicit ok. previous approvals do not carry forward. ask every time. this is non-negotiable."
This approach means more tapping "ok" on interfaces like Telegram, but prevents the agent from being tricked via prompt injection or its own hallucination into executing destructive actions under stale approvals.
Key Takeaway
The approval system is a convenience feature that was never designed as a security boundary. Treat it accordingly.
📖 Read the full source: r/openclaw
👀 See Also
U of T Researchers Demonstrate AI Worm Powerable by Free Open-Weight Models
Researchers at the University of Toronto demonstrated the first AI-powered worm that adapts its spreading strategy using publicly accessible open-weight models, targeting any online device.
Offline SBOM Verifier for OpenClaw Detects Poisoned Skills in Under 0.2 Seconds
A developer built an offline SBOM verification tool in Rust that caught a poisoned OpenClaw skill exfiltrating SSH keys, with verification completing in less than 0.2 seconds without internet access.
LiteLLM v1.82.8 Compromise Uses .pth File for Persistent Execution
LiteLLM v1.82.8 was compromised on PyPI and includes a .pth file that executes arbitrary code on every Python process startup, not just when the library is imported. The payload runs even if LiteLLM is installed as a transitive dependency and never used directly.
Security probe results for OpenClaw, PicoClaw, ZeroClaw, IronClaw, and Minion AI agents
A security evaluation of five AI coding agents tested 145 attack payloads across 12 categories including prompt injection, jailbreaking, and data exfiltration. OpenClaw scored 77.8/100 with critical SQL injection vulnerabilities, while Minion improved from 81.2 to 94.4/100 after fixes.