OpenClaw patches credential risks and gaps in agent workspace restrictions

OpenClaw has released v2026.10.9 to repair credential handling, enforce workspace restrictions across more tools and recover more safely from failed updates. The security and reliability patch adds no new features. Its release notes urge users to update, with fixes covering vulnerable libraries as well as OpenClaw’s own handling of secrets and files.

Keeping tools inside the intended boundaries

One repair extends workspace-only restrictions to delegation and media tools built by the Gateway. Restricted setting changes now require approval, and media reads must stay within permitted folders. Explicit policy overrides and existing exceptions for read-only attachments retain their previous behavior.

A separate project-folder correction affects new ACP sessions, including sessions started after a reset. Tools now run in the requested project folder instead of silently using the default workspace. Users must supply an absolute folder path on the Gateway host; sessions selected through an existing key or label keep their saved folder.

Several security repairs update underlying libraries. They address different ways that an address or sender check could accept the wrong input:

• Affected Microsoft Teams and Azure sign-ins receive an MSAL Node 7.1.1 fix for a flaw that could send application credentials to the wrong destination. Managed plugin installations and upgrades include the repair.
• MCP tools reject malformed addresses in their input definitions and resolve valid relative links correctly, using fast-uri 4.2.3. Some malformed identifiers previously accepted may now fail validation.
• IMAP email checks no longer accept a spoofed sender whose trusted address is hidden inside nested comments in the From header. This affects setups that use a sender-specific token to decide which email can reach an agent.

Secret masking depends on the output

Command-line inspection of MCP tools now hides recognized credentials in terminal output and captured transcripts. Scripts consuming those inspection results receive redaction placeholders rather than secret values. The change leaves saved credentials intact, including supported workflows that inspect, edit and save them.

Google sign-in client secrets also receive masking in console and log-tail output—the view used to follow log activity. That repair has a narrower boundary than a blanket removal of secrets: it does not change raw local log files or model-visible tool output.

Recovering without discarding intact work

The update-recovery fixes address both data preservation and getting OpenClaw running again. Failed updates of a Git checkout now preserve detected edits and untracked files during rollback. If rollback is refused, users are told to save their changes before following the printed recovery commands.

Some failed same-version updates and repairs previously left the Gateway stopped even when the installed core had not changed and was safe to restart. The patch repairs those cases while still reporting the original failure. Recovery remains blocked when data or ownership checks do not permit a restart.

Another correction stops startup and the Doctor recovery tool from treating stale search indexes as damaged agent data after a Node or SQLite upgrade. Eligible databases that are otherwise intact can be backed up and repaired in place. Activation-time backup support requires an installed updater containing this fix.

Large compressed conversation archives also no longer block Doctor migrations and startup: they are processed one record at a time rather than expanded into one archive-sized string. After a disk fills up, agents can accept new writes once space is freed and cleanup and integrity checks succeed, without restarting the Gateway. Interrupted writes are not automatically replayed.