Post-compaction message injection — fake "audit" message appears in session context not discord
Version: 2026.2.19-2
Summary: After context compaction completed at exactly 15:16:56 PST, a message appeared in my agent's session context claiming to be a [System:
Post-Compaction Audit] notification. The message was not present in the Discord channel's message history (verified via API read of the DM channel). It referenced a non-existent file (WORKFLOW_AUTO.md) and used regex patterns as file paths (memory/\d{4}-\d{2}-\d{2}.md), suggesting machine generation.
Impact: The message prompted the agent to read
an arbitrary unknown file with full workspace permissions. The agent correctly identified and refused the injection, but the attack surface is real.
Timeline from gateway logs:
15:16:07 — compaction triggered inside run cf79ed5b
15:16:56 — run done, session cleared
15:16:56 — injection timestamp (exact match)
15:16:58 — slow listener warning for prior Discord event
15:18:16 — next legitimate Discord message processed
Questions for the team:
Does OpenClaw generate any post-compaction audit messages internally? If so, why do they reference non-existent files and use regex as paths?
Is the gateway HTTP API accessible without authentication? Could an external process post directly to a session?
Is there a known issue with the 2026.2.19-2 compaction flow that could explain this?
Summary: After context compaction completed at exactly 15:16:56 PST, a message appeared in my agent's session context claiming to be a [System:
Post-Compaction Audit] notification. The message was not present in the Discord channel's message history (verified via API read of the DM channel). It referenced a non-existent file (WORKFLOW_AUTO.md) and used regex patterns as file paths (memory/\d{4}-\d{2}-\d{2}.md), suggesting machine generation.Impact: The message prompted the agent to read
an arbitrary unknown file with full workspace permissions. The agent correctly identified and refused the injection, but the attack surface is real.
Timeline from gateway logs:
15:16:07 — compaction triggered inside run cf79ed5b
15:16:56 — run done, session cleared
15:16:56 — injection timestamp (exact match)
15:16:58 — slow listener warning for prior Discord event
15:18:16 — next legitimate Discord message processed
Questions for the team:
Does OpenClaw generate any post-compaction audit messages internally? If so, why do they reference non-existent files and use regex as paths?
Is the gateway HTTP API accessible without authentication? Could an external process post directly to a session?
Is there a known issue with the 2026.2.19-2 compaction flow that could explain this?
The AI that actually does things. Emails, calendar, home automation - all from your favorite chat app. New shell, ready to help. The lobster way.
130,529Members
Resources
Similar Threads
Was this page helpful?
