OpenClaw chat plugins let agents read off-limits channels

Four OpenClaw plugins that connect AI agents to corporate chat platforms could let those agents read messages from channels the operator had deliberately placed off limits, according to a GitHub security advisory published on 5 October 2026.

The affected packages are the OpenClaw plugins for Microsoft Teams, Feishu, Matrix and Google Chat, distributed on npm. The advisory, GHSA-g7fw-3gjp-g5hf, says that in affected versions "channel read actions could skip target allowlists". Where a caller supplied an explicit read target, that target could reach channels or rooms outside the configured read policy.

An allowlist in this context is a list of the channels an operator has decided the agent is permitted to touch. The flaw meant that list could be bypassed when a read was aimed at a named target rather than left to the plugin's own scoping.

The advisory describes the scope narrowly. It covers caller-supplied targets for reads of messages, reactions, pins, members and related metadata in the four named plugins. It says the issue does not change OpenClaw's trusted-operator model, and does not create per-user isolation within a single Gateway. In other words, the fix tightens one specific control rather than adding a new security boundary.

On impact, the advisory says a lower-trust sender, or an agent that has been steered by someone else, could use a channel read action to retrieve content or metadata from a target the operator's allowlist was meant to exclude. How much data that exposes depends on what the connected bot account can see. The advisory states that practical impact depends on the bot account's platform permissions. A bot added to every channel in a workspace would therefore be a far larger problem than one added to a handful.

The first stable patched release is version 2026.8.1. OpenClaw advises operators to upgrade each affected channel plugin to 2026.8.1 or later. For those who cannot upgrade immediately, the advisory gives two interim steps: disable explicit-target read actions, or restrict the connected bot account at the platform level so that it only has access to the channels the operator intends to allow.

That second mitigation is a useful general lesson for teams running agents on chat platforms. An allowlist held in the agent's own configuration is a software control, and software controls can fail. The permissions granted to the bot account inside Microsoft Teams, Feishu, Matrix or Google Chat are enforced by the platform itself, and they hold even when the agent's own policy logic does not. Defences that sit in two different places are harder to bypass with a single bug.

The advisory does not say whether the issue was exploited, who reported it, or when it was introduced. It does not give a CVE identifier or a severity score. It was published on 5 October 2026 and lists the four npm packages as affected.

Organisations running OpenClaw with any of the four chat integrations should check which plugin version they are on and compare it with 2026.8.1. Those who relied on channel allowlists as the main control over what an agent could read may also want to review which conversations the bot account itself can reach, since under the flaw that account's permissions, not the allowlist, set the real limit.