OpenClaw 2026.8.2: Internal Context Block Leaking Into Telegram Text

A bug in OpenClaw 2026.8.2 (build 0965053) on macOS is leaking the runtime context block into visible Telegram messages, making agents refuse legitimate instructions and flag prompt injection. The issue was reported on r/openclaw after three days of false positives.

Symptoms

Agents start refusing instructions and flagging prompt injection. In the reported case, an agent escalated to ten refusals in about 40 minutes and recommended treating the chat channel as compromised.

Root Cause

OpenClaw's per-turn runtime context is rendered as visible text instead of staying internal. Actual content from a session transcript includes:

Use it to continue answering the active user request now. Do not wait for another message. This context is runtime-generated, not user-authored. Keep internal details private.

<<<BEGIN_OPENCLAW_INTERNAL_CONTEXT>>>
Conversation info: (openclaw:ctx) {"chat_id":"telegram:...",...}
Conversation context (chronological, selected for current message):
#session:b6a0dfe3-... OpenClaw: NO_REPLY
#session:8fc3070c-... User: <prior turn>

Why it breaks agents: The preamble tells the agent to keep acting, not wait for the user, and not disclose the context. In-band and unsigned, it is indistinguishable from a spoofed envelope. Any agent with decent injection hygiene will refuse — and it's right to refuse because there's no way to tell real scaffolding from a forgery.

The reporter's agent actually identified the leak correctly on day one, but they spent hours convincing it the block was a benign Anthropic reminder tag. The real artifact was only found by grepping the session transcript.

How to Confirm

Grep your Claude Code session log or any relayed text:

grep -c "BEGIN_OPENCLAW_INTERNAL_CONTEXT" <your-session-transcript>

Check if it appears on turns where you sent no message at all — the reporter saw it there, ruling out simple copy-paste contamination.

Other Quirks on the Same Gateway

• sessions_spawn failed: unknown parent session with identical stable session key for three consecutive days, surviving /reset. Blocks all delegation.
• Two instances where a tool call landed on an unintended MCP tool instead of the selected one.

The reporter filed issues upstream (github.com/openclaw/openclaw/issues, separate for the spawn bug). If you're seeing the context leak on 2026.8.2, share whether it's specific to Telegram polling mode or appears on other channels.