Back to Newsletter
v2026.6.8OpenClawSecurity
Richer Telegram messages, a faster Control UI, the Skill Workshop, and a smoother automatic upgrade for Discord/Slack/WhatsApp channels.
Spans OpenClaw 2026.5.28–2026.6.8. Telegram replies now render tables, lists, and blockquotes with line breaks preserved; the Control UI chat got noticeably faster on startup, streaming, and first reply; and the new Skill Workshop lets agents propose, review, and roll back skills. Under the hood, channel state and cron stores move to SQLite with automatic migration, and the newest models land (Claude Opus 4.8, Claude Haiku 4.5, GLM-5.2). One platform change to know about: Discord, Slack, and WhatsApp plugins are now installed on demand rather than bundled — Bot It Out handles this for you automatically, so adding those channels keeps working without any action on your part.
New features
New features
- OpenClawTelegram messages now render rich formatting — tables, lists, and blockquotes — with line breaks preserved.
- OpenClawSkill Workshop: propose, review, and roll back skills, with a dedicated `skill_workshop` agent tool.
- OpenClawWhatsApp can now bind to ACP (agent-client-protocol) sessions.
- OpenClawNew `/btw` command for adding side context mid-session, and a redesigned `/usage` footer with credential-aware limits.
- OpenClawNewest models available: Claude Opus 4.8, Claude Haiku 4.5, and GLM-5.2.
- OpenClawGitHub Copilot agent runtime support and a Codex Supervisor plugin for delegated Codex workflows.
- OpenClawGateway can advertise local services over Tailscale Serve service names.
- OpenClawEncrypted PDF extraction for document workflows.
Improvements
Improvements
- OpenClawFaster Control UI chat: quicker startup, incremental stream rendering, transcript caching, and visibly faster first replies.
- OpenClawChannel delivery hardened across Telegram, WhatsApp, Slack, Discord, Matrix, iMessage, and Microsoft Teams.
- OpenClawInbound channel queues and iMessage monitor state moved to SQLite-backed storage for reliability.
- OpenClawMCP tool results (links, audio, images) are normalized before provider conversion, avoiding dropped or broken follow-ups.
- OpenClawStricter validation of gateway ports, timeouts, and callback inputs — malformed values are rejected earlier.
- OpenClawDoctor adds disk-space health checks and more stable post-upgrade probes.
Fixes
Fixes
- OpenClawSafer upgrades: cron and agent-registry stores auto-migrate to SQLite before the runtime reads them.
- OpenClawOptimistic chat/TUI messages stay stable across history reloads, aborts, and reconnects instead of disappearing or duplicating.
- OpenClawService env placeholders no longer mask secrets from the state-dir `.env`.
Breaking changes
Breaking changes
- OpenClawDiscord, Slack, and WhatsApp channel plugins are now installed on demand instead of bundled — `channels add` no longer auto-installs them. Bot It Out's deployer now enables each plugin before adding the channel, so this is fully handled for you; only relevant if you run the OpenClaw CLI by hand.
- OpenClawKey-free web-search providers (Parallel Free, DuckDuckGo, Ollama, Codex Hosted Search) now require explicit opt-in rather than being selected automatically as a fallback.
- SecurityHTTP session and model-override surfaces now require admin privileges.
Notes
Notes
- SecurityLocal channel setup trust mechanisms were hardened.
- SecurityUnreadable OpenAI/Anthropic tool schemas are quarantined without broadening the set of allowed tools.
- SecurityUntrusted workspace setup-only channel loads are blocked, and unsafe OAuth/token lifetimes and timeouts are rejected.
Running an older version?
Upgrade your instance from the dashboard to get everything above.
Open Dashboard