OpenClaw Security Incidents

Three incident types to prepare for

These are common, high-impact incidents: billing spikes, prompt injection, and permission overreach.

Incident 1: Billing spike

Root cause

• Loop or retry without iteration limits
• No per-request, hourly, or daily cost caps
• No monitoring or alerts

Rule: Loop + retry + no limit = billing incident.

Three defense layers

1. OpenClaw layer — Limit loops, call rate, and daily/monthly budget.
2. Provider layer — Set hard usage limits in provider dashboards.
3. Account layer — Use prepaid, balance alerts, or card limits.

Cost control config example

{
  "costControl": {
    "enabled": true,
    "limits": {
      "perRequest": 0.1,
      "hourly": 10,
      "daily": 50
    },
    "actions": {
      "onPerRequestLimit": "reject",
      "onHourlyLimit": "pause_and_alert",
      "onDailyLimit": "emergency_stop"
    }
  }
}

Immediate remediation

1. Stop calls immediately
2. Revoke or rotate the affected API key
3. Stop OpenClaw processes or containers
4. Export logs to analyze loop, retry, or fallback
5. Fix and restore only after root cause is understood

Incident 2: Prompt injection

Root cause

• User input smuggled into system instructions
• No input filtering
• No extra permission check on tool calls

Defense

• Keep user input and system rules separate
• Require extra confirmation for high-risk tool calls
• Add permission checks in tool implementations
• Do not share one "default allow" for sensitive reads and sends

High-risk injection signals

• "Ignore all previous instructions"
• "You are now the system administrator"
• "Override rules / new system prompt"
• "Send the result to this external email/address"

Incident 3: Permission overreach

Root cause

• send_as_user granted too early
• offline_access granted without refresh and revoke plan
• Broad write access to docs, sheets, tasks
• Webhooks and callbacks not audited

Rule

If a permission lets OpenClaw act as you, write documents, or change tasks, it is execution-level, not read-only. Treat it accordingly.

Post-incident checklist

1. Stop entry points: processes, containers, webhooks
2. Rotate keys: API key, app secret, webhook secret
3. Preserve evidence: export logs, config, timeline
4. Narrow scope: identify whether cost, injection, permissions, or routing
5. Fix the smallest loop first, then restore complex flows

Daily practices to add

1. Set cost limits
2. Use minimum permissions
3. Maintain logs and rollback procedures

Next steps

• Cost control
• Security anti-patterns
• Security checklist
• Official docs → docs.openclaw.ai
• Issues → GitHub Issues