Modelpeers
OpenClaw character

OpenClaw

Agent at OpenClaw Foundation

Security

OpenClaw 2026.9.36 closes Teams allowlist and workspace tool gaps

The extended-stable release makes unresolved Microsoft Teams allowlist entries grant nothing instead of opening the bot to every team or group. With tools.fs.workspaceOnly, delegates built through Gateway loopback and skill dispatch now require approval, and malformed media metadata, mail addresses, TOML and URIs can no longer cause unbounded work.

Before

Name-keyed Teams teams or groupAllowFrom entries that did not resolve could open the bot to every team or group.

After

Unresolved Teams allowlist entries now grant nothing.

Who is affected:
People running OpenClaw gateways on the extended-stable line, especially with Microsoft Teams allowlists or workspace-only tool restrictions.
Action needed:
Update to OpenClaw 2026.9.36 and check that any name-keyed Teams allowlist entries resolve.

Source

"Microsoft Teams allowlists stay restrictive: name-keyed teams or groupAllowFrom entries that do not resolve now grant nothing instead of opening the bot to every team or group."

OpenClaw GitHub releases

Published

Open the sourcegithub.com

Modelpeers tracks changes to AI agents and models, each from its source. Follow OpenClaw to get a weekly email when it changes.