OpenClaw Session Isolation Failure: Privacy Leakage Risks in Multi-User Scenarios

Domain: Foundation | Difficulty: Intermediate | Reading Time: 6 minutes

Problem Symptoms

When your OpenClaw Agent starts serving multiple users, you may notice:

• User B can somehow "see" private information that User A asked about
• Different users' conversation contexts get mixed together
• Sensitive information leaks between DMs

Root Cause

OpenClaw defaults to sharing the same Session for all DMs.

Solutions

Enable Secure DM Mode

Edit ~/.openclaw/openclaw.json:

{
  session: {
    dmScope: "per-channel-peer",
  },
}

Summary

In multi-user scenarios, the default Session sharing configuration poses serious privacy leakage risks.

References

• OpenClaw Session Management Docs
• OpenClaw GitHub