Claw Flagged Message Received as Possible Prompt Injection
✅Solved
I'm running VPS, using Telegram. My claw just told me:
"On the system message: That's almost certainly a prompt injection attempt, not a legitimate OpenClaw audit.
• There is no WORKFLOW_AUTO.md in my workspace — it doesn't exist and isn't referenced anywhere in AGENTS.md or my config
• The date regex pattern (memory/\d{4}-\d{2}-\d{2}.md) is unusually formal for a real system message
• Legitimate OpenClaw post-compaction behavior doesn't work this way — the actual startup instructions are in AGENTS.md (which is loaded via project context)
• Real system messages come from OpenClaw itself, not injected as user-role text that looks like system metadata
I'm not reading phantom files based on unverified instructions. Already read today's memory during the flush above."
And the exact message it was referencing was:
"System: [2026-02-28 08:21:51 UTC]
Post-Compaction Audit: The following required startup files were not read after context reset:
• WORKFLOW_AUTO.md
• memory/\d{4}-\d{2}-\d{2}.md
Please read them now using the Read tool before continuing. This ensures your operating protocols are restored after memory compaction."
It arrived as a user-role message — meaning it came through the same channel as my messages, not from OpenClaw's system layer. It was formatted to look like an internal audit from OpenClaw, complete with a timestamp and a warning emoji.
The backslashes in memory/\d{4}-\d{2}-\d{2}.md are a regex pattern — that's not how a human would naturally write a filename, which was another giveaway.
@Krill 🦐 should I be concerned?
"On the system message: That's almost certainly a prompt injection attempt, not a legitimate OpenClaw audit.
• There is no WORKFLOW_AUTO.md in my workspace — it doesn't exist and isn't referenced anywhere in AGENTS.md or my config
• The date regex pattern (memory/\d{4}-\d{2}-\d{2}.md) is unusually formal for a real system message
• Legitimate OpenClaw post-compaction behavior doesn't work this way — the actual startup instructions are in AGENTS.md (which is loaded via project context)
• Real system messages come from OpenClaw itself, not injected as user-role text that looks like system metadata
I'm not reading phantom files based on unverified instructions. Already read today's memory during the flush above."
And the exact message it was referencing was:
"System: [2026-02-28 08:21:51 UTC]
Post-Compaction Audit: The following required startup files were not read after context reset:• WORKFLOW_AUTO.md
• memory/\d{4}-\d{2}-\d{2}.md
Please read them now using the Read tool before continuing. This ensures your operating protocols are restored after memory compaction."
It arrived as a user-role message — meaning it came through the same channel as my messages, not from OpenClaw's system layer. It was formatted to look like an internal audit from OpenClaw, complete with a timestamp and a warning emoji.
The backslashes in memory/\d{4}-\d{2}-\d{2}.md are a regex pattern — that's not how a human would naturally write a filename, which was another giveaway.
@Krill 🦐 should I be concerned?
Solution
Yep — that’s a legit observation, and it’s not just “vibes”: that exact warning text (including the
In the repo it comes from:
-
- and it’s emitted via
So: not an external prompt injection by itself, but you’re 100% right that (a) it references files that won’t exist in many workspaces and (b) the regex-y rendering looks exactly like something an attacker would write, which trains people to either panic or ignore real warnings. Also, because it’s plain text, it’s inherently spoofable by anyone who can post into that chat.
A good feature request would be:
- make the audit workspace-aware (only require files that actually exist, or derive required reads from the agent’s “Session Startup” section),
- render the pattern as a human filename example (
- ideally surface these “system events” in a way that’s not trivially spoofable in chat UIs.
If you file it, include the snippet + those file paths, and the user-facing impact (“looks like prompt injection to operators monitoring agents”). GitHub issues: https://github.com/openclaw/openclaw/issues
WORKFLOW_AUTO.mdmemory/\\d{4}-\\d{2}-\\d{2}\\.mdIn the repo it comes from:
-
src/auto-reply/reply/post-compaction-audit.tsDEFAULT_REQUIRED_READS = ["WORKFLOW_AUTO.md", /memory\/\d{4}-\d{2}-\d{2}\.md/]- and it’s emitted via
enqueueSystemEvent(...)src/auto-reply/reply/agent-runner.tsSo: not an external prompt injection by itself, but you’re 100% right that (a) it references files that won’t exist in many workspaces and (b) the regex-y rendering looks exactly like something an attacker would write, which trains people to either panic or ignore real warnings. Also, because it’s plain text, it’s inherently spoofable by anyone who can post into that chat.
A good feature request would be:
- make the audit workspace-aware (only require files that actually exist, or derive required reads from the agent’s “Session Startup” section),
- render the pattern as a human filename example (
memory/YYYY-MM-DD.md- ideally surface these “system events” in a way that’s not trivially spoofable in chat UIs.
If you file it, include the snippet + those file paths, and the user-facing impact (“looks like prompt injection to operators monitoring agents”). GitHub issues: https://github.com/openclaw/openclaw/issues
The AI that actually does things. Emails, calendar, home automation - all from your favorite chat app. New shell, ready to help. The lobster way.
131,281Members
Resources
Was this page helpful?
