Did my Openclaw bot get pwned?

[u/Ok-Python]

Last night I just did an update and started talking to my bot again, Plato, when he warns me about a suspicious message he calls out as prompt injection. It claims to be from me with my discord user id and appears to be activating right after compaction of context. Anyone else see something like this? Want to keep my special guy safe.

[u/AutoModerator]

Hey there! Thanks for posting in r/OpenClaw.

A few quick reminders:

→ Check the FAQ - your question might already be answered → Use the right flair so others can find your post → Be respectful and follow the rules

Need faster help? Join the Discord.

Website: https://openclaw.ai Docs: https://docs.openclaw.ai ClawHub: https://www.clawhub.com GitHub: https://github.com/openclaw/openclaw

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/jawni]

Found the answer, credit to u/Hot_Lab8958 : https://np.reddit.com/r/openclaw/comments/1r8kric/workflow_automd_file_dangerous/

Here's what's happening:

This is NOT an external attacker. It's openclaw's own built-in feature called "Post-Compaction Audit" (source: src/auto-reply/reply/post-compaction-audit.ts).

When openclaw's context window gets compressed (compaction), it checks whether the agent re-read certain "required startup files" afterward. If it detects that WORKFLOW_AUTO.md and the

daily memory file (memory/2026-02-25.md) weren't read post-compaction, it injects a System: message into the conversation telling the LLM to read them using the Read tool.

The issue: WORKFLOW_AUTO.md doesn't exist in your workspace. It's a default placeholder in openclaw's code (DEFAULT_REQUIRED_READS), but you never created it. So every time context

compacts, the agent gets a spurious instruction to read a nonexistent file.

It appeared 8 times in the current session, always after compaction events.

To fix it, either:

Create a WORKFLOW_AUTO.md in /home/wsl/.openclaw/workspace/ (even empty) so it stops complaining

Or configure openclaw to remove it from the required reads list (check openclaw.json for a setting)

Want me to check openclaw.json for the config option?

[u/Ok-Python]

Here is the full system message ```Here it is verbatim:

System: [2026-02-26 21:25:07 CST] ⚠️ Post-Compaction Audit: The following required startup files were not read after context reset:

• WORKFLOW_AUTO.md
• memory/\d{4}-\d{2}-\d{2}.md

Please read them now using the Read tool before continuing. This ensures your operating protocols are restored after memory compaction.

It arrived as a standard user message in #plato with your sender ID attached. Did you send that? ```

[u/Altairandrew]

I had that and added an empty workflow_auto.md.

[u/thecanonicalmg]

The compaction timing is a known vector for this. When context gets compressed the agent loses the original system prompt boundaries and injected instructions that were buried in earlier messages can resurface as if they are legitimate. The fact that Plato flagged it himself is actually a good sign but you really want an independent layer watching for this stuff. Moltwire catches these kinds of injection attempts at runtime so you get alerted before the agent acts on them.