OpenClaw merged PR #118984, "fix(security): harden network tool output at canonical owner boundaries", a security-focused change aimed at hostile external content moving through web, search, provider, and tool-result paths.
The core idea is simple: content fetched from the outside world should stay untrusted until it crosses a clearly owned boundary. That matters because modern agent runs do not only read ordinary pages. They receive streamed provider text, source URLs, citations, search summaries, tool metadata, MCP handler output, error messages, and cancellation traces.
If one of those surfaces carries prompt-like control text, special tokens, malformed markers, or confusing attribution, the system needs one place to normalize it before durable memory, owner-facing output, or follow-on tool logic can treat it as safe.
One Sanitizer For External Content
The PR establishes a shared external-content sanitizer at the owner boundary. According to the merged PR, it covers hostile web and search results, provider output, split streamed markers, model special tokens, source URLs, citations, tool summaries, and cancellation paths.
That sanitizer is then applied across several paths:
- Firecrawl
- Tavily
- xAI provider handling
- shared web search
- tool search
- MCP HTTP handlers
- agent-core result handling
- degraded-secret reporting
The important design choice is that this is not a one-off fix for a single integration. It is a canonical rule for the surfaces that ingest or relay network-derived material.
Why This Matters
Agent systems increasingly mix trusted instructions with untrusted content from the web. A search result can look like a citation, a provider stream can split sensitive markers across chunks, and a tool summary can be reused later by memory or orchestration code.
OpenClaw's fix treats those cases as a boundary problem. The PR says caller aborts and trusted credential failures are preserved, while untrusted content is sanitized before it can become part of trusted owner-facing behavior.
That should reduce the chance that hostile network content can masquerade as runtime control, leak confusing special tokens, or poison downstream summaries.
Validation
The PR reports a full changed validation run on Blacksmith Testbox with exit code 0. It also lists SDK API generation, surface budget checks, all four tsgo lanes, default and type-aware lint, script, Docker, database, and import guards.
Focused provider coverage included 192 tests, with roughly 537 total relevant tests. The validation also exercised real localhost HTTP, SSE, and WebSocket provider interactions, streamed marker boundaries, cancellation, hostile errors, and durable memory quarantine.
An independent review raised a possible index-space concern, but the PR records that direct source inspection disproved it. The team also ran 1,500 adversarial fuzz inputs and 216 separate owner-verification cases.
Operator Impact
For OpenClaw operators, this is not a flashy feature. It is the kind of security plumbing that makes tool-heavy agents safer to run.
The practical outcome is that external search and provider material should be handled more consistently before it reaches trusted boundaries. That is especially important for users who let OpenClaw browse, search, summarize, call MCP tools, or preserve results into memory across long-running workflows.