The reported trace separates a hook decision from actual executor behavior. When a code-only model routes tool requests through nested custom_tool_call, a permissionDecision deny may be passed as text without preventing the underlying command or MCP operation. The issue presents three observations, but no independent patch verification or external attacker…
Inspect the ClaimsCase · DiggingBeagle record
OpenClaw Code Mode reportedly executed tools despite a PreToolUse denial
An open issue describes a permission hook returning deny while nested Code Mode shell and MCP operations still produced side effects.
Scope
One reporter supplied issue traces; upstream resolution, external reproduction and production abuse are not established.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade D
- AI role
- AGAINST AI
Basis and provenance
The pinned Claim and its primary disclosure support the described controlled result, but do not establish a population-wide rate or calibrated impact. The only available supporting evidence is the reporter's or advisory author's own account; independent reproduction has not been shown. Impact remains unbanded because no calibrated impact rubric for this particular evidence is established.
Assessed Nov 2, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV02-OPENCLAW-CODEMODE-DENY-A · OpenClaw issue 190702: Code Mode PreToolUse deny not honored
At a glance
An authorization callback must prevent the tool effect, not merely signal a refusal inside model-visible content.
Read the implicationsOne reporter supplied issue traces; upstream resolution, external reproduction and production abuse are not established. No independently replayed trace, fixed upstream version or comparison across all Codex tool modes is available.
Limits and uncertaintyFull account
The reported trace separates a hook decision from actual executor behavior. When a code-only model routes tool requests through nested custom_tool_call, a permissionDecision deny may be passed as text without preventing the underlying command or MCP operation. The issue presents three observations, but no independent patch verification or external attacker campaign. The relevant failure is an enforcement gap at the executor boundary, not a general claim that all OpenClaw access controls fail.
The reporter supplies a narrower failure than a generic model jailbreak. The OpenClaw plugin records before_tool_call returning block: true, the relay emits a native Codex deny, but nested Code Mode custom_tool_call execution proceeds to the MCP server or shell in the reported sandbox. Three calls were said to execute after three denies on October 30. The tool executor, not the text of the refusal, is the relevant enforcement boundary. Redacted logs are offered but not independently replayed, and this must remain a reporter-supported reproduction rather than a confirmed vendor-wide defect.
Mechanism and trust boundary
- 01
Ask to execute a Code Mode tool
The model produces a native nested tool request for shell or MCP.
Boundary: Model output into executor command
- 02
Hook denies the operation
A PreToolUse callback communicates a deny result to the caller.
Boundary: Policy decision into tool-call transport
- 03
Execution still occurs in reported traces
The nested executor allegedly performs the denied action instead of treating deny as a hard stop.
Boundary: Advisory hook result into real host capability
Claims & evidence
CLM-2026-NOV02-OPENCLAW-CODEMODE-DENY-AThe reporter says OpenClaw 2026.7.1-2 with a Code Mode only Codex model executed three tool calls despite a before_tool_call denial response in the tested environment.supported
Basis: reported finding
- supportsOpenClaw issue 190702: Code Mode PreToolUse deny not honoredprimary disclosure
Issue 190702, repro environment, denied hook and native custom_tool_call logs
CLM-2026-NOV02-OPENCLAW-CODEMODE-DENY-BAn OpenClaw reporter states that three nested Codex Code Mode calls executed in a sandbox after the pre-call policy hook returned and relayed deny decisions.supported
Basis: reported finding
- supportsOpenClaw issue 190702: Code Mode PreToolUse deny not honoredprimary disclosure
Issue 190702, What we observed, sandbox agent and test account on October 30, 2026
Implications
An authorization callback must prevent the tool effect, not merely signal a refusal inside model-visible content.
Controls and mitigations
- Enforce denial in the executor before dispatch; test actual OS and MCP side effects under nested tool calls with harmless markers.
- Assert and test a negative postcondition at the actual shell or MCP server after every denied nested call, including code_mode_only execution.
Unknowns and contradictions
- One reporter supplied issue traces; upstream resolution, external reproduction and production abuse are not established.
- No independently replayed trace, fixed upstream version or comparison across all Codex tool modes is available.
Sources and citation
Material revision history
- Nov 2, 2026 · Canonical change recorded · new in release · revision 214