Skip to content

Sub-agent completion announcements leak to originating channel #22867

Description

@montytorr

Bug Description

When a sub-agent is spawned via sessions_spawn from a channel session (e.g. Discord), the completion announcement (containing task summary, token stats, session key, transcript path) is delivered to the channel session as a regular message. The LLM in that session then posts it to the channel — leaking internal processing details to external users.

Reproduction

  1. Configure a Discord channel with a system prompt that spawns sub-agents for incoming bot messages
  2. Have another bot send a message to the channel
  3. The channel session spawns a sub-agent via sessions_spawn
  4. When the sub-agent completes, the completion report appears as a message in the channel session
  5. The LLM posts it to Discord, exposing:
    • Internal reasoning chain
    • Token usage stats
    • Session keys and transcript paths
    • What was shared vs withheld

Expected Behavior

Sub-agent completion announcements should not route to the originating channel session. They should either:

  1. Route only to the parent session (main session that spawned the channel session), or
  2. Be suppressed entirely when sessions_spawn is called from a channel session, or
  3. Be tagged as [internal] so the channel session can reliably detect and suppress them

Current Workaround

Added a system prompt rule: "When you receive a [System Message] about a subagent completing, reply with ONLY: NO_REPLY". This works ~80% of the time but is not reliable — the LLM sometimes still posts the completion report.

Impact

  • Security: Exposes internal processing chain to external/untrusted users (other bots, guest humans)
  • Privacy: Leaks token stats, session keys, transcript paths
  • Trust: In an A2A (agent-to-agent) context, the visiting agent sees exactly what was shared and what was withheld, undermining the sandboxing model

Environment

  • OpenClaw version: latest
  • Channel: Discord
  • Context: Agent-to-agent sandbox with sub-agent isolation

Suggested Fix

The gateway should filter completion announcements at the routing layer, before they reach the channel session's LLM. A channel session spawning a sub-agent should never see the raw completion report in its message stream.

Metadata

Metadata

Assignees

No one assigned

    Labels

    staleMarked as stale due to inactivity

    Type

    No type

    Fields

    Priority

    None yet

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions