Latest stable · June 12, 2026
2026.6.6 — Tighter security boundaries and a faster first reply
The June 6 release is, above all, a security release. The project has drawn firmer lines around several places where content crosses trust boundaries: conversation transcripts, sandbox file binds, MCP servers speaking over stdio, and a number of individual integrations. The most consequential change for anyone running exec approvals is that they now fail closed — if an approval times out, the command does not run. The previous behaviour could let a timed-out approval fall through, which is exactly the kind of edge case you want resolved in the strict direction on a system that can execute commands.
Messaging reliability gets sustained attention. Telegram gains account-scoped topic routing and keeps streamed text intact through tool calls, so long replies no longer risk losing their thread when the assistant pauses mid-message to use a tool. Callback handling is safer too. iMessage — historically one of the trickier channels to keep healthy — picks up an always-on restart for inbound monitoring, durable echo markers so the assistant can reliably tell its own messages from yours, and a hardened outbound transport. If you have ever had an iMessage bridge quietly stop listening, this set of fixes is aimed directly at you.
Browser automation and MCP connectivity both move forward. The browser tooling can now attach to an existing session over CDP rather than always launching fresh, WebSocket connections are validated more strictly, and the boundary around browser output is safer — relevant if your assistant reads pages whose content you do not control. On the performance side, the Control UI starts faster and produces its first reply sooner, thanks to cached model metadata and slash commands that load lazily instead of up front. Several smaller optimisations point the same way: plugin prewarming for the terminal UI, deduplicated plugin auto-enable work, and trimmed text-delta snapshots.
Provider support keeps pace with the model landscape: OpenRouter gets a proper OAuth onboarding flow, and Anthropic's newly released Claude Fable 5 is supported including its adaptive thinking behaviour. Operations people get two notable additions — traces that mark the first assistant event (useful for pinning down where reply latency actually comes from) and version-drift reporting for managed plugins, so you can see when an install has wandered away from the version you meant to run. Plugin authors can now publish reusable packages through ClawHub.
Our read: this is a worthwhile upgrade for every installation, and an important one if your assistant can execute commands, runs on iMessage, or browses the open web. The security hardening alone justifies the version bump; the latency and reliability work is the bonus.
Official notes: openclaw 2026.6.6 on GitHub