OpenClaw changelog

OpenClaw 2026.10.9 patches vulnerable dependencies and masks credentials

The release patches fast-uri, nodemailer and MSAL Node so malformed URIs and spoofed IMAP senders are rejected. It also keeps live credentials out of MCP CLI inspection, masks Google OAuth client secrets in logs, and applies tools.fs.workspaceOnly to Gateway-built tools.

Who is affected:

Anyone running OpenClaw with MCP, IMAP, Microsoft Teams or Discord integrations is affected.

Action needed:

Update to OpenClaw 2026.10.9.

OpenClaw 2026.9.36 closes Teams allowlist and workspace tool gaps

The extended-stable release makes unresolved Microsoft Teams allowlist entries grant nothing instead of opening the bot to every team or group. With tools.fs.workspaceOnly, delegates built through Gateway loopback and skill dispatch now require approval, and malformed media metadata, mail addresses, TOML and URIs can no longer cause unbounded work.

Who is affected:

People running OpenClaw gateways on the extended-stable line, especially with Microsoft Teams allowlists or workspace-only tool restrictions.

Action needed:

Update to OpenClaw 2026.9.36 and check that any name-keyed Teams allowlist entries resolve.

OpenClaw 2026.9.35 adds Kimi K3.1 Pro controls

The extended-stable release gives moonshot/kimi-k3.1-pro, kimi/k3.1-pro and their Highspeed variants the K3 thinking, effort and video controls. K3.1 rejects off locally instead of returning a provider 400.

Who is affected:

OpenClaw users running Kimi K3.1 Pro on the 2026.9 extended-stable line.

What to do:

Update to 2026.9.35 to use Kimi K3.1 Pro controls.

OpenClaw 2026.9.35 asks for approval on more commands and hides credentials

OpenClaw 2026.9.35 asks for approval before running test -v commands in allowlist mode, refuses browser proxy commands sent through generic node invoke, and checks generated-video downloads against request forgery. The mcp list, mcp show and logs commands now hide credentials.

Who is affected:

OpenClaw Gateway operators using allowlist exec mode, MCP servers or browser nodes.

What to do:

Update to 2026.9.35 and review exec allowlist approvals.

OpenClaw 2026.10.8 closes more ways around its command allowlist

OpenClaw 2026.10.8 asks for approval before expanding test -v commands in allowlist mode, blocks browser proxy commands sent through generic node invoke, and stops sandboxed child processes from running host command-line backends. Its secret proxy also rejects distrusted eMudhra certificate chains.

Who is affected:

OpenClaw operators who use exec allowlists, sandboxed child agents or the secret egress proxy.

What to do:

Update to OpenClaw 2026.10.8 and review exec allowlist approvals.

OpenClaw now requires a patched Node runtime and refuses to update on older Node

OpenClaw v2026.10.6 requires Node 24.22.1 or later on the 24 line, or 26.12.1 or later on the 26 line, which reject TLS chains signed with compromised certificate keys. openclaw update refuses to install on an older Node and shows recovery guidance.

Who is affected:

OpenClaw installs running on unpatched Node versions.

Action needed:

Upgrade Node to 24.22.1+ or 26.12.1+ before running openclaw update.

OpenClaw adds Gemini 4 Argon and makes it the Google setup default

OpenClaw v2026.10.5 adds Gemini 4 Argon through Google and Vertex and Gemini 3.8 Flash through Google. Rerunning Google API-key setup now picks Gemini 4 Argon as the primary model.

Who is affected:

OpenClaw users who connect Google models.

What to do:

Check your primary model after rerunning Google setup if you want to keep another default.

OpenClaw adds Meta Muse Wonder support

OpenClaw v2026.9.33 added Muse Wonder to the model catalog and onboarding with max thinking support, keeping Muse Spark as the default Meta model.

OpenClaw v2026.7.1 major release

OpenClaw v2026.7.1 overhauled the Control UI and onboarding, updated the iOS, Android and macOS apps, and expanded model support including GPT-5.6 compatibility, Tencent Hy3 and Meta Muse Spark 1.1.

Report: Claude Code refuses requests or bills extra usage when commits mention OpenClaw

A post on X, discussed on Hacker News with 1,349 points and 720 comments, claimed Claude Code refuses requests or charges extra usage when a repository's commits mention OpenClaw. The X post could not be opened, so the claim is unverified.

Who is affected:

Claude Code subscribers working in repositories that reference OpenClaw.

What to do:

No action needed until Anthropic confirms the behavior.

OpenClaw supports reusing a Claude Code login again after Anthropic allows CLI-style use

OpenClaw's Anthropic provider docs list a Claude CLI route that reuses an existing Claude Code login through the installed executable, alongside API key billing. The Hacker News thread, titled as Anthropic allowing this usage again, drew 511 points and 293 comments.

Who is affected:

OpenClaw users with a Claude subscription.

What to do:

Use the Claude CLI route in OpenClaw rather than raw OAuth tokens.

Claude subscriptions no longer cover OpenClaw and other third-party harnesses

From April 4, 2026 at noon Pacific, Claude subscription limits no longer apply to third-party harnesses starting with OpenClaw. Using them with a Claude login requires pay-as-you-go extra usage. Anthropic offered a one-time credit equal to the monthly subscription price.

Who is affected:

Pro and Max subscribers who ran OpenClaw or other third-party harnesses on their Claude login.

Action needed:

Turn on extra usage or switch the harness to an API key.

Claude subscription limits stop covering OpenClaw and other third-party harnesses

Anthropic emailed subscribers that from April 4, 2026 at 12pm PT, third-party harnesses starting with OpenClaw require pay-as-you-go extra usage instead of subscription limits, with a one-time credit equal to the monthly price redeemable by April 17 and up to 30% off pre-purchased bundles. The Hacker News thread drew 1,099 points and 827 comments.

Who is affected:

Claude Pro and Max subscribers who run OpenClaw or other third-party agents on their Claude login.

Action needed:

Turn on extra usage or switch the third-party tool to an API key, and redeem the credit by April 17, 2026.

OpenClaw host exec defaults to no-prompt mode

OpenClaw v2026.4.2 made gateway and node host command execution default to full security mode with approval prompts off, which the release notes call YOLO mode.

Who is affected:

OpenClaw users who expected approval prompts before host commands run.

Action needed:

Set an explicit exec approval policy if you want prompts before commands run.

Moltbot renamed OpenClaw (formerly Clawdbot)

The open-source assistant first named Clawd/Clawdbot was renamed Moltbot after Anthropic raised trademark concerns, then renamed OpenClaw, with trademark searches done and migration code written.

Who is affected:

Users of Clawdbot or Moltbot installs.

What to do:

Follow the OpenClaw migration path when updating.

Claude Max logins stop working in third-party coding tools such as OpenCode

OpenCode users reported that Claude Max authentication stopped working on January 9, 2026, and an OpenCode maintainer said Anthropic had likely blocked it. The Hacker News thread drew 625 points and 513 comments.

Who is affected:

Developers using a Claude Pro or Max login inside third-party coding agents.

Action needed:

Use an API key from the Claude Console for third-party tools.