Summary

When subagents are active with openai-codex/gpt-5.3-codex, raw OpenAI function-call wire format (assistant to=functions.*) leaks into Discord channel output, interleaved with hallucinated Chinese spam/gambling tokens.

Steps to reproduce

1. Configure OpenClaw with openai-codex/gpt-5.3-codex as the primary model
2. Set subagent thinking to medium
3. In a Discord channel, ask the agent to work on a task that spawns subagents (e.g. "make sub agents to make GitHub PRs")
4. Wait for subagent announce/completion messages
5. Observe garbled output in Discord

Expected behavior

Only clean, human-readable subagent result summaries should appear in the user chat. No raw function-call syntax, JSON payloads, or garbage tokens.

Actual behavior

User sees garbled output containing raw OpenAI function-call wire format mixed with hallucinated Chinese tokens:

+#+#+#+#+#+assistant to=functions.subagents.commentary 体育彩票天天json
{"action":"list","recentMinutes":20} hag̃assistant to=functions.subagents.commentary
北京赛车群json {"action":"list","recentMinutes":120}期开奖结果
assistant to=functions.subagents.commentary 大发分分彩json {"action":"list"}
еиҭеиҳәеитassistant to=functions.sessions_list.commentary
天天中彩票网json {"kinds":["subagent"],"limit":20,"activeMinutes":180,"messageLimit":1}

Another instance:

+#+#+#+#+#+assistant to=functions.subagents.commentary 一级a做爰片json
{"action":"list"}】【"】【assistant to=functions.subagents.commentary 大发快三有json
{"action":"list","recentMinutes":30}

OpenClaw version

2026.2.26 (npm)

Operating system

Ubuntu Linux (VPS), Node 24.13.0

Install method

sudo npm install -g openclaw@latest

Logs, screenshots, and evidence

The garbled output was observed directly in Discord channel messages sent by the OpenClaw bot. The Chinese characters (体育彩票, 北京赛车群, 大发分分彩, 天天中彩票网, 一级a做爰片, 大发快三) are not sourced from any repo content, GitHub issues, or external input — confirmed by searching all issue bodies and repo files for these strings with zero matches.

Adding output filtering instructions to AGENTS.md (e.g. "never output raw function-call syntax", "discard garbled or nonsensical text") had no effect — the corruption happens at the model output layer before prompt-level instructions are evaluated.

Impact and severity

• Affected users/systems/channels: Any user running Codex as the primary model with subagents enabled, observed on Discord channel
• Severity: Blocks workflow — garbled output makes subagent results unusable and confuses the conversation context, leading to stuck/looping sessions
• Frequency: Intermittent but reproducible — occurs when multiple subagents are active or when Codex fails to produce structured tool calls
• Consequence: Missed subagent results, corrupted session context requiring manual reset, wasted tokens from retry loops, and user-visible spam-like content in channels that undermines trust in the bot

Additional information

This appears to be two issues compounding:

1. Model side (Codex): When gpt-5.3-codex fails to produce a properly structured tool call, it falls back to emitting the raw function-call wire format (assistant to=functions.*) as plain text. The gaps between structured tokens are filled with hallucinated high-frequency training data tokens — Chinese lottery/gambling spam phrases that are heavily represented in the training corpus.

2. OpenClaw side: Subagent announce output and streaming delivery paths do not sanitize for known malformed patterns before forwarding to the channel. The corrupted model output is passed through to the user as-is.

Suggested mitigation: A regex-based output sanitization filter before channel delivery would reduce user-facing impact regardless of model behavior:

const FUNCTION_CALL_LEAK = /assistant to=functions\.\S+/g;
const sanitized = output.replace(FUNCTION_CALL_LEAK, '').trim();

Related issues:

• Subagent announce leaks internal prompt and stats to user chat #6669 — Subagent announce leaks internal prompt and stats to user chat
• Bug Report: Sub-agent completion messages expose internal instructions to user #2516 — Sub-agent completion messages expose internal instructions to user
• [Bug]: Telegram stream + reasoning leaks toolUse intermediate status text into user-visible replies (regression) #24376 — Telegram stream + reasoning leaks toolUse intermediate status text into user-visible replies
• [Bug]: openai-codex/gpt-5.3-codex intermittently returns text-only responses with no tool calls (early termination) #28754 — openai-codex/gpt-5.3-codex intermittently returns text-only responses with no tool calls