OpenClaw v2026.5.25-alpha: Sub-Agent Context Isolation Limits Data Leakage by Default

OpenClaw's sub-agent architecture leaks context by default. v2026.5.25 added config-level isolation (limiting bootstrap files), but runtime data flow between skills and sub-agents remains uncontrolled. Karpathy publicly called the 400K-line codebase a 'vibe coded monster' and cited the security attack surface as the reason he won't run it with private data. A middleware layer that intercepts agent-to-agent and skill-to-system calls at runtime, enforcing granular data boundaries per skill and per sub-agent, would let the 500K+ existing OpenClaw users harden their setups without migrating to NanoClaw or buying enterprise solutions from Cisco.