Bitter Frontier What coding agents just made possible, where the bottleneck moved, and what deserves attention.

Evidence record / openclaw

A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.

2026-10-13-openclaw-stable-repaired-sandbox-revocation-and-credential-output-gaps-without-new-advisories

Stable repaired sandbox, revocation and credential-output gaps without new advisories. 9.7 repairs two P0-labeled issues: trusted-proxy HTTP callers could have their mandatory sandbox skipped on new sessions, and registered background execution could continue after its operator lost access. 10.1 rejects NUL execution arguments, fails closed on unresolved peer credentials and prevents stale Codex sessions mutating successor workspaces. 10.2 repairs masking for credentials split across long-output chunks. All named fixes are in 10.3. No new repository advisory accompanies these in-window release repairs; the separate wider-database events in section 17 concern older disclosures.

Channel: tagged-release, all retained at 2026.10.3; extended-stable coverage not fully resolved. Half: defect. Date: 2026-09-30 first stable sandbox/revocation fixes, 2026-10-10 other hardening, 2026-10-12 redaction fix.

Operator consequence: Use the current 10.3 pin rather than interpreting 9.7’s two fixes as a complete current floor. Read versioned security/reliability release bullets even when the repository advisory list is quiet. Extended-stable’s later-fix coverage and whether the corresponding bugs exist on its base require code-specific checks; absence from notes is not proof of absence.

Receipt

Finding metadata

Confidence
high

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-openclaw-stable-repaired-sandbox-revocation-and-credential-output-gaps-without-new-advisories

Profile citations

  • OpenClaw / claim / stable-security-repair-coverage
  • OpenClaw / posture / governance

Source links

Primary links, including exact changelog lines when available.

  1. OpenClaw
    commit2026-10-13-openclaw-stable-repaired-sandbox-revocation-and-credential-output-gaps-without-new-advisoriesgithub.com/openclaw/openclaw/commit/fa92bd54c449b71a2104c292af5c2fe1ce112567commit2026-10-13-openclaw-stable-repaired-sandbox-revocation-and-credential-output-gaps-without-new-advisoriesgithub.com/openclaw/openclaw/commit/08f5fb80f301d8236cadb8acc853d95566fd7f10merged pr2026-10-13-openclaw-stable-repaired-sandbox-revocation-and-credential-output-gaps-without-new-advisoriesgithub.com/openclaw/openclaw/pull/155964official docs2026-10-13-openclaw-stable-repaired-sandbox-revocation-and-credential-output-gaps-without-new-advisoriesgithub.com/openclaw/openclaw/issues/156098merged pr2026-10-13-openclaw-stable-repaired-sandbox-revocation-and-credential-output-gaps-without-new-advisoriesgithub.com/openclaw/openclaw/pull/156106merged pr2026-10-13-openclaw-stable-repaired-sandbox-revocation-and-credential-output-gaps-without-new-advisoriesgithub.com/openclaw/openclaw/pull/161480git compare2026-10-13-openclaw-stable-repaired-sandbox-revocation-and-credential-output-gaps-without-new-advisoriesgithub.com/openclaw/openclaw/compare/6e84f49a...v2026.10.3tagged commit file2026-10-13-openclaw-stable-repaired-sandbox-revocation-and-credential-output-gaps-without-new-advisoriesopenclaw/openclaw / CHANGELOG/2026.10.1.mdtagged commit file2026-10-13-openclaw-stable-repaired-sandbox-revocation-and-credential-output-gaps-without-new-advisoriesopenclaw/openclaw / CHANGELOG/2026.10.2.mdofficial docs2026-10-13-openclaw-stable-repaired-sandbox-revocation-and-credential-output-gaps-without-new-advisoriesgithub.com/openclaw/openclaw/security/advisories

Versioned source: run artifact