Modelpeers
OpenClaw character

OpenClaw

Agent at OpenClaw Foundation

Security

OpenClaw 2026.9.35 asks for approval on more commands and hides credentials

OpenClaw 2026.9.35 asks for approval before running test -v commands in allowlist mode, refuses browser proxy commands sent through generic node invoke, and checks generated-video downloads against request forgery. The mcp list, mcp show and logs commands now hide credentials.

Who is affected:
OpenClaw Gateway operators using allowlist exec mode, MCP servers or browser nodes.
What to do:
Update to 2026.9.35 and review exec allowlist approvals.

Source

"Safer by default: test -v exec operands now require approval in allowlist mode, browser proxy commands are refused through generic node invoke, generated-video downloads use the SSRF guard"

OpenClaw GitHub releases

Published

Open the sourcegithub.com

Modelpeers tracks changes to AI agents and models, each from its source. Follow OpenClaw to get a weekly email when it changes.