OpenClaw May Leak Raw Internal Completion Payloads into User Chat: How to Confirm, Contain, and Reduce Risk

A newly filed bug report suggests OpenClaw can sometimes deliver raw runtime/internal completion text into end-user chat instead of a normal assistant-style reply.

Source issue: openclaw/openclaw#61433

This matters because the leaked text is not just ugly. It can expose internal file paths, routing labels, wrapper text, and completion metadata that should stay inside the runtime boundary.

The report points to a shared risk area across:

• isolated cron announce deliveries
• subagent completion announces
• other runtime-generated follow-up/completion events that reuse the same announce path

What the failure looks like

Instead of seeing only the final user-facing reminder or summary, the user may receive a message that also contains internal orchestration text, for example:

• file paths written during the run
• transport/routing notes
• internal wrapper text such as completion-event framing
• metadata blobs that should have been rewritten before delivery

The important operational detail is this: the underlying task may still have succeeded. The failure is in the last-mile presentation boundary between internal completion data and user-visible chat output.

Why operators should care

This is more than a formatting bug.

1) It can leak details you did not intend to show users

Even when the leaked content is not a secret, it may still reveal:

• local filesystem layout
• channel routing structure
• internal runtime/event wording
• execution flow that confuses end users

2) It weakens trust in automations

If a bedtime reminder, digest, or completion notice suddenly includes plumbing text, users stop trusting the automation layer and start treating every background workflow as unstable.

3) It is easy to misdiagnose

Teams may blame the transport adapter or the model output itself, when the more likely problem is the announce/rewrite boundary inside OpenClaw.

Why the issue looks credible

The OpenClaw subagents documentation already describes the intended behavior of the completion handoff:

• completion metadata is runtime-generated internal context
• the requester agent should rewrite that content in normal assistant voice
• raw internal metadata should not be forwarded directly to user chat

Reference: docs/tools/subagents.md

In other words, the project already distinguishes between:

1. internal completion context for orchestration
2. sanitized user-facing text for delivery

That is why this report looks like a real boundary bug, not just a “we phrased the prompt badly” problem.

How to confirm you are hitting the same bug

You likely have the same issue if all of the following are true:

• the task finishes successfully
• the outgoing chat message contains obvious internal/plumbing text
• the leaked text includes things a normal assistant reply would never say, such as file paths, routing labels, wrapper blocks, or completion framing
• the symptom appears on cron announce or subagent completion flows, not just one hand-written prompt

A practical confirmation checklist:

1. Trigger a controlled background task that writes a file and returns a short final message.
2. Compare the intended final message with the actual delivered chat message.
3. If the delivered message includes extra internal summary text, you are likely hitting the same boundary defect.

What to do right now

1) Treat announce output as a presentation boundary, not ground truth

If a job appears to have “leaked internals,” separate two questions:

• Did the background task itself complete?
• Did the final delivery render correctly?

Do not assume the whole run failed just because the final message is messy.

2) Avoid stuffing operational notes into the final reply text

Until this is fixed, keep the user-facing completion message extremely narrow:

• one clean summary line
• no file paths
• no internal status narration
• no transport-specific wording

This will not remove the bug, but it reduces the blast radius if the wrong payload escapes.

3) Review automated reminders and digests that talk about files or routing

High-risk candidates include automations that:

• write artifacts to disk and then report the path
• pass around channel-specific delivery context
• rely on internal completion summaries rather than a single clean output sentence

4) Collect evidence before filing follow-up reports

Useful evidence includes:

• OpenClaw version
• whether the trigger was cron, subagent, or another internal completion path
• the exact final user-visible text
• the intended user-facing text
• whether the problem reproduces across multiple channels

Redact secrets, but keep enough structure to show the internal/user boundary failure clearly.

Temporary mitigation ideas

These are workarounds, not fixes:

• prefer shorter final completion messages
• keep file-writing and user delivery as separate logical steps in your run design
• review whether critical user-facing alerts should be sent by a simpler path until the announce boundary is hardened

If you operate customer-facing automations, this is a good moment to audit any workflow where internal run summaries might accidentally become public-facing output.

Bottom line

The reported problem is not that OpenClaw cannot complete background work. The more concerning issue is that internal completion context can sometimes escape the rewrite layer and land in user chat unchanged.

For production operators, the immediate goal is simple:

• confirm whether your flows are affected
• reduce how much internal detail can appear in final messages
• capture clean repro evidence so maintainers can harden the shared announce path

Common rollout question

What is the safest temporary rule for customer-facing automations until this announce boundary is fixed?

Treat every runtime-generated completion message as untrusted until it has been minimized to one plain-language sentence with no file paths, routing notes, or internal status framing. If a workflow cannot tolerate even a brief internal-text leak, route the final customer-facing notification through a simpler manual or separately reviewed delivery step until maintainers harden the shared announce path.

Release gate before trusting completion announcements again

Use this page as a high-intent safety gate before you re-enable customer-visible automation that depends on internal completion announcements.

1. Channel boundary: prove the same completion event is rewritten correctly in every channel you use, not just in the web UI.
2. Raw metadata scan: search the delivered message for session ids, task ids, tool payload names, file paths, stack traces, and routing notes.
3. Failure-mode sample: keep one redacted bad message and one expected clean message side by side for maintainers.
4. Customer-facing fallback: define the manual or separately reviewed delivery path you will use if the rewrite layer fails again.
5. Regression trigger: rerun the check after OpenClaw upgrades, channel plugin upgrades, or changes to cron/subagent completion handlers.

The goal is not just to hide one leaked field. It is to prove that internal runtime context cannot bypass the user-facing rewrite boundary under normal production triggers.

If troubleshooting traffic lands here, separate user-facing leakage from internal task telemetry

GA4 now places this page beside setup, troubleshooting, and other operator bug entries. That means readers may arrive after seeing an odd completion message, without knowing whether it exposed private runtime details or only noisy task metadata.

Before deleting logs or changing the announcement path, split the incident this way:

1. The message reached a user-facing channel: preserve the exact rendered text, channel, timestamp, and triggering task before editing any templates.
2. Only internal logs contain the payload: treat it as observability noise first, then verify whether any summarizer or bridge can repost it externally.
3. A completion event asked for a user update: rewrite it into normal assistant voice and strip runtime metadata before sending, instead of forwarding raw event fields.

This keeps high-intent troubleshooting readers focused on containment and safe handoff, not broad log cleanup that does not reduce exposure.

Sources

• Issue: openclaw/openclaw#61433
• Docs: Subagents

Turn metadata-leak traffic into a reply-boundary acceptance checklist

If you arrived because an internal completion announce payload can leak raw runtime metadata into a user reply, do not only add a string filter. Split the path across three boundaries: whether internal event payloads can enter user-visible channels, whether the completion renderer separates system fields from body text, and whether exception fallbacks serialize debug objects directly.

The minimal acceptance checklist includes one raw announce payload, the final user-visible message, the renderer field allowlist, and a sanitized output sample for the exception path. That routes metadata-leak traffic toward message boundaries, redaction strategy, and regression tests instead of leaving it at a single leaked screenshot.