Advisory Weakness Curation

OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns ### Summary A sandboxed session could use cross-agent `sessions_spawn` to create a child under an agent configured with `sandbox.mode="off"`, downgrading runtime confinement. ### Impact In mixed-agent setups that allow cross-agent spawning, a sandboxed requester could escape into an unsandboxed child runtime. ### Fix Spawn-time sandbox inheritance is now enforced: if the requester is sandboxed and the resolved child runtime would be unsandboxed, spawn is rejected. ### Affected and Patched Versions - Affected: `<= 2026.2.26` - Patched: `2026.3.1`

OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns A sandboxed session could use cross-agent `sessions_spawn` to create a child under an agent configured with `sandbox.mode="off"`, downgrading runtime confinement.

OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns A sandboxed session could use cross-agent `sessions_spawn` to create a child under an agent configured with `sandbox.mode="off"`, downgrading runtime confinement.