OpenClaw says Trail of Bits audit found 23 vulnerabilities; stable fixes shipped

OpenClaw said on 21 September that a security audit by Trail of Bits, conducted through OpenAI's Patch the Planet programme, resulted in 27 private repository advisories and three standalone hardening pull requests. The project says 24 advisories described severity-rated vulnerabilities, 23 were classified as confirmed vulnerabilities and one concerned a vulnerability that had already been fixed before submission.

According to OpenClaw's recap, the 24 rated reports contained no Critical findings, two High, 16 Medium and six Low findings. Three additional reports were treated as defence-in-depth findings because OpenClaw says they did not cross a documented trust boundary. Maintainers say every actionable issue has been repaired and all three hardening pull requests were merged.

The public recap describes recurring authorization failures rather than publishing exploit details. OpenClaw says some follow-on work failed to carry the original request's permissions, creating paths where later steps could gain access the initiating request did not have. Other findings involved aliases or multiple names for the same user or feature, where a security check could evaluate one identifier before the runtime used another.

A second cluster involved checks that were separated from the final resource or action. OpenClaw describes archive inspection that did not cover the full extracted contents and file paths that changed after approval. The audit also found cases where permissions changed while an agent was already running but the active work did not immediately inherit the revocation. The project's stated remediation principle is to bind approval to the exact identity, file or action actually used and to propagate permission changes into in-flight work.

OpenClaw says every issue is repaired on its main branch and that the fixes are included in stable 2026.8.1 and the 2026.7.33 LTS line. GitHub independently records the v2026.8.1 release as published on 31 August and a signed v2026.7.33 tag dated 18 September. Those release records establish that the named versions exist, but they do not by themselves map each private advisory to a public fix commit. Some findings also remained unpublished because OpenClaw says they were fixed before reaching a stable release.

OpenAI's Patch the Planet documentation independently confirms the programme's operating model: Trail of Bits engineers manually review findings, reproduce evidence, remove duplicates, reassess severity, help develop patches and coordinate disclosure with maintainers. That supports the audit process OpenClaw describes, but OpenAI's programme page does not publish the OpenClaw-specific advisory list or severity totals.

The OpenClaw-specific advisories remain private, and a project-specific Trail of Bits report was not available in the sources reviewed for this article. The counts, severity distribution and claim that every actionable issue is repaired therefore remain attributed to OpenClaw. No source reviewed for this update documented exploitation of these audit findings in the wild. The story is marked Corroborated rather than Confirmed until the private findings, a Trail of Bits engagement report or equivalent independent evidence establishes the issue-by-issue remediation record.