Security Check

Agent Timeout: Prevent Runaway Sessions

Agent sessions can run indefinitely without a configured timeout. A stuck loop, a compromised agent, or an overly complex task can consume resources for hours.

Why It Matters

Runaway agents consume API credits, hold resources, and may continue executing harmful actions undetected. A timeout ensures automatic termination of long-running sessions.

How to Fix

Set agents.defaults.timeoutSeconds to a reasonable value. 300 seconds (5 minutes) works for most use cases.

openclaw.json
{
  "agents": {
    "defaults": {
      "timeoutSeconds": 300
    }
  }
}

Check your config for this vulnerability

The free scanner tests this and 11 other security checks.

Skip the hardening

Clawctl manages all 12 security checks automatically. Enterprise defaults, zero config.