OpenClaw macOS deep link confirmation truncation can conceal executed agent message
OpenClaw's macOS desktop client displayed only the first 240 characters of agent messages in confirmation dialogs while executing the full message after user approval. An attacker could pad messages with whitespace to hide malicious payloads and trick users into approving unintended actions.
What happened
OpenClaw's macOS desktop client versions 2026.2.6 through 2026.2.13 displayed only the first 240 characters of agent messages in confirmation dialogs for openclaw://agent deep links without an unattended key, but executed the full message after the user clicked 'Run'.
An attacker could pad a message with whitespace to push a malicious payload outside the visible preview in the confirmation dialog, increasing the chance a user would approve a different message than the one actually executed.
Reported impact
If a user ran the deep link, the agent could perform actions leading to arbitrary command execution depending on the user's configured tool approvals and allowlists, according to the advisory.
This was a social-engineering mediated vulnerability where the confirmation prompt could misrepresent the executed message.
Index analysis
The vulnerability was assigned CVE-2026-26320 and classified as High severity under CWE-451 (User Interface Misrepresentation of Critical Information).
Governance controls
OpenClaw released patched version 2026.2.14 which enforces a strict message length limit for unkeyed deep link confirmations and ignores delivery/routing parameters (deliver, to, channel) unless a valid unattended key is provided.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.