OpenClaw
Sourced signals for OpenClaw: release changes, governance moves, runtime shifts, and operator consequences. Each links to the run that produced it. The OpenClaw profile carries the current evergreen state.
October 2026
-
OpenClaw's Bash predicate repair has not reached a published channel
- POSIX Gateway owners relying on exec allowlists: restrict adversarial shell work and host exposure until a published version contains this repair. Enforce any interim predicate restriction outside the affected classifier, with whole-process containment and narrowly scoped credentials where untrusted work must continue.
- Watch for a containing stable tag, then run harmless substitution and case-variant refusal tests through the real approval chain. Tag ancestry plus recorded refusals would settle delivery and deployed enforcement; the maintainer's production-chain probe was not reproduced here.
- The separately released final-hook-argument binding does not repair this shell classifier. Review effort cannot protect a request that the classifier never sends for approval; containment and release tracking now consume the attention that a narrow allowlist was meant to save.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
OpenClaw Workshop replaces proposals with immediate versioned edits
- Skill-library owners moving to 10.7: use the required patched Node runtime and replace the old proposal recipe. Set skills.workshop.autonomous.mode=off when a person must initiate learning; manual learning remains available. Off is not a new pre-application approval queue.
- If retaining auto, inspect changes already effective, exercise Undo and keep independent backups beyond ten versions. Learned Workshop skills bypass the ordinary per-agent skill allowlist, and background review uses an additional foreground-route model run.
- Port proposal integrations to current Workshop methods and recover needed drafts and old backups manually. A bad-edit/restore test plus correction minutes and review spend would establish whether the removed proposal queue saves attention rather than postpones it.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
OpenClaw's beta binds approval to a hook's final arguments
- Operators on either stable line: inventory before_tool_call hooks and remove or pin plugins you do not control. An approval for the original arguments does not cover a later replacement. Spend review on the hook's actual transformation rather than trusting the displayed approval.
- Plugin authors can try beta.3 and return requireApproval with final parameters. Test that an unapproved rewrite is blocked and an approved replacement executes exactly those parameters; plugins relying on silent replacement must change.
- A stable containing 34d07e7b0dc1b5f0ed54de67a9647d9e6b8c23de or a verified equivalent backport, plus the replacement-argument test, would settle adoption. Neither a future version number nor an issue closure proves inclusion; no exploit was executed here.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
September 2026
-
The approved-exec fix finally shipped, and the long-term line moved to a build without it
- Run 2026.8.1 or later on the latest channel if you rely on the exec approval prompt. Do not read extended-stable as the safer choice; it is the unfixed one.
- Allow Always saved path-only grants before 2026.8.1 (GHSA-74gc); review persisted grants after upgrading.
- Evidence that would settle residual: an extended-stable build containing ab5611f0.
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
August 2026
-
The approved-exec fix is still in no release
- A tagged install still can run different bytes than the ones you approved. Say that to anyone relying on the prompt.
- Evidence that would settle: any tag where ab5611f0 is an ancestor.
-
Approved exec could run different bytes than the ones you approved
- The fix is on the default branch and in no release. State that plainly to anyone relying on the approval prompt in a stable install.
- When the same defect class appears in two unrelated codebases inside a fortnight, treat it as a property of the pattern rather than of the vendor. If you build approval UI, the invariant to test is that the string displayed and the string executed are the same object, not two renderings of one intention.
Run: 2026-08-17-weekly-digest-2026-08-10_2026-08-17-frontier-v0
-
The workspace-boundary fix is on neither stable channel, and the one that moved this window still ships without it
- Re-audit rather than upgrade-and-relax. Both stable channels are checkable in one command: neither published tarball contains the new path-resolution functions.
- Do not treat the sandbox path assertion as the barrier between an agent and the rest of the host on a stable channel. Keep agent workspaces on filesystems you would be willing to expose.
- Watch for the first non-prerelease tag on the 2026.8 line. That is the earliest point the fix can reach a stable channel.
Run: 2026-08-10-weekly-digest-2026-08-03_2026-08-10-frontier-v0
-
OpenClaw's workspace boundary fix reached beta and stopped there
- On stable OpenClaw the workspace boundary is still not a containment barrier, two windows after the bypass was first recorded. Either run the beta deliberately, or do not treat the workspace path as a security boundary for agents handling untrusted content.
Run: 2026-08-03-weekly-digest-2026-07-27_2026-08-03-frontier-v0
July 2026
-
OpenClaw's sandbox check returned success while the escape worked
- Do not treat the workspace boundary as a containment barrier on any current release, and resolve which build you are actually running from the package registry rather than the release page.
Run: 2026-07-27-weekly-digest-2026-07-02_2026-07-27-frontier-v0
June 2026
-
OpenClaw shipped automatic Codex plugin approvals to stable — the one gate that loosened this window
- PR #92625 (stable v2026.6.9, June 21) adds automatic Codex plugin approvals — a gate opened in a fortnight when nearly everyone else was closing them. It cuts against the consent-over-default grain even from a vendor with real accessibility discipline.
- Operators on v2026.6.9 should audit the new automatic Codex plugin approvals against their trust posture; convenience relaxed a consent gate that was previously explicit.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
OpenClaw's WCAG 2.1 AA accessibility pass reached stable
- PR #89822's WCAG 2.1 AA pass reached stable v2026.6.8 (June 16), having been beta-only last window: dark-mode contrast lifted to the 4.5-to-1 floor (verified >=4.8:1), real keyboard `:focus-visible` rings, and a 12-pixel font floor across 136 elements. The cleanest 'reached the operator' event of the fortnight.
- Operators should verify their dashboard against the stable WCAG AA build — check dark-mode contrast and tab through for a visible focus ring; a previously beta-only accessibility capability is now on the default channel.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
A WCAG 2.1 AA pass (beta) and a deliberate consent-over-convenience choice on search
- OpenClaw shipped a measured WCAG 2.1 AA pass on its browser dashboard (contrast above 4.5:1, a focus ring, a 12px font floor across 136 elements) in a BETA tag (v2026.6.7-beta.1), plain-language mobile provider states, and pinned-commit ClawHub skill installs. It also made key-free web search an explicit opt-in (stable v2026.6.8), trading zero-config convenience for explicit consent on where queries egress.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Exec approvals fail closed on timeout, and HTTP override surfaces are admin-gated
- v2026.6.6 made exec approvals fail closed on timeout (a pending dangerous command now denies rather than proceeds) across a dozen-surface boundary sweep that also closed a deleted-agent ACP bypass; v2026.6.8 gated HTTP session/model override surfaces behind admin privileges. The correct reversibility default for a surface aimed at non-experts.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Skill Workshop adds a pending-proposal approval workflow with CLI/Gateway review and a skill_workshop agent tool
- Skill Workshop introduces a new pending-proposal lifecycle that an operator must approve or reject via CLI or Gateway before a skill takes effect, inserting a human-in-the-loop gate into skill provisioning.
- The skill_workshop agent tool lets agents themselves file proposals, expanding the automation surface; operators must decide who may review and who may self-approve.
- Decision is for the control-plane admin/skill-author: configure the review path and authority for skill proposals.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Enhanced plugin isolation tightens the plugin sandbox boundary in the 2026.6.1 line
- Enhanced plugin isolation changes the sandbox boundary around plugins, including the externalized Tokenjuice and GitHub Copilot plugins now run as separate plugins.
- Operators running third-party or externalized plugins should re-test plugin behavior against the tightened isolation, since capabilities previously available in-process may now be constrained.
- Single runtime-admin decision: verify plugins still function under the new isolation after upgrade.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
May 2026
-
Content-boundary hardening suite across inbound surfaces
- Operators evaluating OpenClaw against 'is it safe to put agents on real channels' can use this suite as evidence of a threat model, not just a feature list.
- Gateway operators should verify whether `gateway.auth.rateLimit` was unset in their config — the on-by-default ratelimit changes observable behavior for non-browser/HTTP auth flows.
- Plugin authors should treat `allowFrom` sender allowlists as the canonical inbound boundary; post-dispatch filtering is the older model.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
Per-sender tool policies via channel-scoped sender keys
- Operators running OpenClaw with public-facing channels can now restrict dangerous tools by requester identity rather than only by agent. Review your tool surfaces and decide whether the broader trust model (per-channel × per-sender) belongs in your deployment.
- Authority restriction now extends across global, agent, group, core, bundled, and plugin tool surfaces — operators should re-audit which surfaces hold authority decisions in their deployment and whether the requester-level layer makes some prior per-agent restrictions redundant.
- Three claim-level updates land in the same release: memory-wiki ingest now requires admin scope, Obsidian search requires write scope, and `openclaw models auth login --provider openai` defaults to ChatGPT/Codex login (API-key setup is now behind `--method api-key`). Setup scripts assuming read-only or API-key-first paths need to be updated.
Run: 2026-05-13-partial-cycle-openclaw-refresh-2026-05-13-frontier-v0
-
Per-agent message restrictions, gated code install, and onboarding wayfinding
- Operators deploying public-facing or sandboxed agents should evaluate `tools.message.crossContext` and `tools.message.actions.allow` overrides to restrict agent message sends to the current conversation without changing the global bot policy.
- Operators running long-horizon OpenClaw sessions should know that session memory is now bounded: the memory dreaming promotion cap compacts oldest auto-promoted sections while preserving user-authored notes. Unbounded auto-memory growth is no longer the default behavior.
- Operators deploying OpenClaw for new users should test the improved CLI onboarding wayfinding: setup, onboarding, configure, and channel commands now explain the next useful command at each step.
Run: 2026-05-12-partial-cycle-openclaw-2026-05-07_2026-05-12-frontier-v0
-
Accessibility is becoming a frontier capability.
-
Persistent agent state is becoming a product surface
- Developers need to know which goals, memory patches, recaps, sessions, and skill maintenance loops shaped a serious run.
Run: 2026-05-07-commit-harvest-2026-04-23_2026-05-07-frontier-v1
-
Permissions, secrets, and sandboxes are moving into the foreground
- The harness must make trust state visible: what can be read, what can be changed, which credentials are exposed, and where execution happens.
Run: 2026-05-07-commit-harvest-2026-04-23_2026-05-07-frontier-v1
-
Accessibility is a frontier capability, not marketing polish
- Everyday adoption depends on setup recovery, visible progress, voice/chat surfaces, readable UI, OAuth clarity, and fewer dead ends.
Run: 2026-05-07-commit-harvest-2026-04-23_2026-05-07-frontier-v1
-
Agent systems are growing control planes
- Once agents coordinate across tasks, runtimes, gateways, and integrations, operators need liveness, cost, role, session, and recovery controls.
Run: 2026-05-07-commit-harvest-2026-04-23_2026-05-07-frontier-v1
-
Integrations are volatile; the operating loop has to be durable
- Provider lists, plugin systems, transports, and model profiles will keep changing.
Run: 2026-05-07-commit-harvest-2026-04-23_2026-05-07-frontier-v1