OpenClaw Consulting

What's new

OpenClaw Release Highlights

The latest stable OpenClaw releases, rewritten in plain English — what changed, why it matters, and what each upgrade means for a running setup. Sourced from the official release notes on GitHub.

Latest stable · June 12, 2026

2026.6.6Tighter security boundaries and a faster first reply

The June 6 release is, above all, a security release. The project has drawn firmer lines around several places where content crosses trust boundaries: conversation transcripts, sandbox file binds, MCP servers speaking over stdio, and a number of individual integrations. The most consequential change for anyone running exec approvals is that they now fail closed — if an approval times out, the command does not run. The previous behaviour could let a timed-out approval fall through, which is exactly the kind of edge case you want resolved in the strict direction on a system that can execute commands.

Messaging reliability gets sustained attention. Telegram gains account-scoped topic routing and keeps streamed text intact through tool calls, so long replies no longer risk losing their thread when the assistant pauses mid-message to use a tool. Callback handling is safer too. iMessage — historically one of the trickier channels to keep healthy — picks up an always-on restart for inbound monitoring, durable echo markers so the assistant can reliably tell its own messages from yours, and a hardened outbound transport. If you have ever had an iMessage bridge quietly stop listening, this set of fixes is aimed directly at you.

Browser automation and MCP connectivity both move forward. The browser tooling can now attach to an existing session over CDP rather than always launching fresh, WebSocket connections are validated more strictly, and the boundary around browser output is safer — relevant if your assistant reads pages whose content you do not control. On the performance side, the Control UI starts faster and produces its first reply sooner, thanks to cached model metadata and slash commands that load lazily instead of up front. Several smaller optimisations point the same way: plugin prewarming for the terminal UI, deduplicated plugin auto-enable work, and trimmed text-delta snapshots.

Provider support keeps pace with the model landscape: OpenRouter gets a proper OAuth onboarding flow, and Anthropic's newly released Claude Fable 5 is supported including its adaptive thinking behaviour. Operations people get two notable additions — traces that mark the first assistant event (useful for pinning down where reply latency actually comes from) and version-drift reporting for managed plugins, so you can see when an install has wandered away from the version you meant to run. Plugin authors can now publish reusable packages through ClawHub.

Our read: this is a worthwhile upgrade for every installation, and an important one if your assistant can execute commands, runs on iMessage, or browses the open web. The security hardening alone justifies the version bump; the latency and reliability work is the bonus.

Official notes: openclaw 2026.6.6 on GitHub

Previous releases

June 9, 2026

2026.6.5Session-history hygiene and sturdier auth

This release fixes a class of bug that corrupts conversations slowly: MCP tool results containing unexpected block types are now coerced properly, which stops Anthropic API 400 errors and — worse — poisoned session history that degrades every later reply. In the same spirit, extended-thinking sessions recover cleanly after the prompt cache expires, and QQBot strips the model's reasoning scaffolding before delivery so raw thinking tags stop leaking into channel replies.

Authentication gets more durable: auth profiles move into SQLite, and npm plugin installs keep their trusted pins across updates. Validation tightens around MCP lease timestamps, prompt-cache tool names, and provider catalogs. macOS users in node mode get a fix for an irritating behaviour where a healthy direct Gateway session would be silently abandoned in favour of a reconnect.

Elsewhere: Parallel ships as a bundled web-search provider with key discovery and onboarding, Google Vertex users on application-default credentials get their model catalog back, and Matrix gains voice-note preflight checks plus thread-aware read and reply behaviour. Upgrades are gentler too — legacy cron JSON stores migrate automatically during doctor preflight, and WhatsApp startup waits are bounded so a slow channel cannot stall the whole boot.

Official notes →

June 3, 2026

2026.6.1Recovery, everywhere

The theme of 2026.6.1 is graceful recovery. Agents and CLI-backed runtimes handle interrupted tool calls, stale session bindings, and compaction handoffs without losing their footing, and media deliveries retry sensibly. Channel reliability improves across the board — Telegram, WhatsApp, iMessage, Slack, Discord, Microsoft Teams, Google Chat, Google Meet, and iOS realtime Talk all get steadier delivery. A long list of timers, retries, OAuth lifetimes, and polling paths are now bounded, closing off ways a run could hang indefinitely.

The chat experience tightens noticeably: sends stay alive while history loads, streams render incrementally without redundant markdown work, drafts stay local while you type, and first-output latency is traced so slowness can be diagnosed rather than guessed at. Skill Workshop matures into a fuller Control UI flow with proposal lists, review states, and searchable file previews.

New surfaces arrive too — Workboard for orchestration, SecretRef plugin manifests, a hosted iOS push relay — alongside provider additions including MiniMax M3 and SQLite-backed model caching for OpenRouter. iMessage monitor state and plugin install ledgers move to SQLite, so restarts recover without rescanning the filesystem.

Official notes →

May 30, 2026

2026.5.28Mobile refresh and stricter inputs

A broad stability release with a visible mobile payoff: the iOS Pro UI is refreshed, the hosted push relay becomes the default, realtime Talk playback improves, and WebChat reconnects without dropping delivery. Session pickers and onboarding hold their state better across reconnects.

Under the hood, agent and Codex runtime recovery firms up — subagents keep their working directories separated, session locks release properly when a timeout aborts a run, and helper failures no longer tear down shared runtime state. Inputs across browser tooling, Gateway ports, cron retries, and several channel surfaces are validated earlier and rejected more clearly when malformed.

Provider coverage expands meaningfully: Claude Opus 4.8 support lands, along with encrypted PDF extraction, GitHub Copilot agent runtime support, a Codex Supervisor plugin path for delegated workflows, and new media models spanning image, music, and voice. CLI and auth paths fail faster with clearer guidance, and legacy api_key auth profiles migrate to the canonical form automatically.

Official notes →

May 28, 2026

2026.5.27Drawing the security lines

This release started the security push that 2026.6.6 finished. Group prompt text is kept out of the system prompt — closing a prompt-injection avenue — hostnames with repeated dots are normalised, side-effecting command wrappers and unsafe Node runtime environment overrides are blocked, exposing the service over Tailscale without auth is rejected outright, and node and device-role approvals now require admin authority.

Codex app-server runs become considerably more reliable, surviving startup failures and helper crashes that previously took shared state down with them. Gateway and reply paths shed repeated hot-path work, so visible replies arrive faster and no longer inherit hidden cleanup timeouts.

Provider support broadens — OpenAI-compatible embedding providers join the core, DeepInfra exposes its full credential-aware catalog, Pixverse adds video generation, and bare Anthropic model ids resolve correctly. Channel delivery is steadier across Telegram, iMessage, Slack, Matrix, QQBot, Discord, and Google Chat, with duplicate approval prompts and misdirected thread sends among the casualties. Release and CI pipelines get harder to wedge, which matters indirectly: it is why stable versions like this one ship on a weekly cadence.

Official notes →

Running an older version?

OpenClaw ships stable releases weekly, and the gap between versions adds up fast — especially the security work. We handle upgrades for clients: reviewing what changed, testing skills against the new version, and migrating configuration safely.

Talk to us about upgrading →