OpenClaw v2026.5.25 Lands iMessage Attachment Fixes, Alpine Linux Support, and MCP Hang Protection

🦞 OpenClaw Updates

v2026.5.25 and v2026.5.25-beta.1: Fixing the Edges That Actually Hurt

Two releases landed in the last 18 hours. The stable v2026.5.25 is a deep bug-fix train across installer, channel, agent performance, and provider behavior. The beta.1 that followed added a few final polish items specific to iMessage and Codex behavior. Neither is a headline features release, and that's entirely the point.

The OpenClaw release cadence has settled into a rhythm that engineers who've operated serious software will recognize: ship a stable point, watch what breaks in the wild, ship beta fixes for the sharp edges, then roll into the next cycle. After the turbulent April/early-May period that Steinberger publicly called "a rough week," the team has stayed disciplined in this mode — and today's releases continue the pattern.

iMessage: Two Real Fixes for Real Users

The two beta.1 additions are both iMessage-specific and both directly address reported community pain:

Attachment routing fixed: iMessage-saved attachments under ~/Library/Messages/Attachments, including wildcard-rooted paths, were being rejected by the path policy rather than processed through the inbound attachment pipeline. This was a regression that silently ate photo shares and file drops in iMessage agent workflows. The fix threads those attachment roots through the existing policy correctly. If you've been wondering why your iMessage-attached images weren't reaching your agent, this is why.

Duplicate watcher deduplication: When channels.imessage.accounts listed both a default account and a named account pointing at the same local Messages source, OpenClaw would spin up duplicate imsg rpc processes and send doubled inbound replies. The fix deduplicates at startup while keeping both accounts usable for outbound sends. This is the kind of bug that reveals how many users are now running non-trivial multi-account iMessage configurations — the ecosystem has matured beyond "one account, one setup."

The Stable Train: What's Actually in v2026.5.25

The stable release is long and covers a lot of ground. Here are the changes that matter most to operators:

Alpine Linux finally works again: The installer now uses Alpine's apk packages for Node.js, npm, and Git instead of falling through to glibc Node tarballs that fail on musl Linux's node:sqlite. If you're running OpenClaw in Docker containers on Alpine — a common production pattern for resource-constrained deployments — this was probably quietly breaking your installs. It's fixed.

MCP tool catalog hangs bounded: A standout reliability fix in this release: bundled MCP tools/list catalog discovery is now bounded by a timeout, so hung MCP servers can no longer block session tool materialization entirely. If you're running external MCP servers alongside OpenClaw — which is increasingly common as the MCP ecosystem grows — a single unresponsive server was silently blocking tool availability for your entire session. That's no longer the case.

OpenRouter context limits corrected: OpenClaw was overstating available context for OpenRouter-routed models because it was not reading endpoint-specific top_provider metadata. This could cause agents to attempt context windows larger than the actual limit, resulting in silent truncation or API errors that were hard to diagnose. The fix pulls the actual per-endpoint context size.

iMessage group message recovery hardened: Malformed anchorless group watch payloads are now recovered by GUID before debounce/routing, with unrecoverable payloads dropped instead of triggering a reply to the sender's DM. The startup catchup cursor also now advances correctly from live-handled rows after a completed catchup pass, preventing restarts from replaying rows that were already processed during a previous live run. These are both subtle but meaningful reliability improvements for group-chat agent workflows.

Config and secrets: exec SecretRef IDs can now include # selectors, which means AWS-style secret#json_key patterns validate properly throughout the config. If you're pulling structured secrets from AWS Secrets Manager, this was a real blocker.

Windows support continues maturing: A cluster of test and launcher fixes ensure that gateway, TUI, Docker-all, generated-module formatting, and optional Discord native opus installer entrypoints work on native Windows. This isn't glamorous, but it's important: Windows is no longer a second-class citizen in the project's CI or runtime.

Performance: agent and provider scan caching: Manifest-backed CLI provider descriptors and fallback provider resolution are now cached, so model fallback retries skip repeated bundled provider runtime scans. The cache invalidates across plugin reloads, so you're not trading performance for staleness. This is a follow-on to the massive 4,100× /models speedup from v2026.5.22 — the team keeps finding more places to stop doing unnecessary work on hot paths.

"Agents/MCP: bound bundled MCP tools/list catalog discovery so hung MCP servers do not block session tool materialization." — v2026.5.25 release notes

The $1.3M/Month Moment Is Still Resonating

Peter Steinberger's screenshot of approximately $20,000 in OpenAI API usage in a single day — roughly $1.3 million worth of tokens over 30 days — continues to circulate widely. Newser covered it, and the broader reaction has been a mix of awe and real operational concern.

The lesson that keeps getting missed in the coverage: this isn't about one engineer being profligate. It's about what happens when an AI agent framework that's deeply integrated into your daily workflow actually works. If OpenClaw is handling your email, your code reviews, your meeting notes, your browsing, and your scheduling — across multiple concurrent sessions and sub-agents — $20K/day is not implausible at scale. The cost structure of agentic AI is fundamentally different from the cost structure of "occasional ChatGPT queries."

This is why model cost hygiene is now an operator skill, not just a developer concern. Setting usage budgets, choosing local-first models for appropriate tasks, and understanding which workflows actually need frontier models are all practices that operators need to develop. The v2026.5.25 provider caching improvements are a small architectural step in this direction — less scanning, less overhead per request — but the bigger work is in how you design your agent workflows.

🔒 Security Tip of the Day

⭐ Skill of the Day: meme-maker

👥 Community Highlights

The Containerization Conversation Is Picking Up

A recent StartupHub.ai write-up highlighted a presentation on OpenClaw in containers, showcasing how agents can be deployed locally or to Kubernetes. The OpenClaw installer demo in that presentation attracted notable attention — partly because the ease of containerized deployment was more accessible than many expected.

This tracks with what we've been hearing from enterprise users: the question is no longer "can we run OpenClaw on our infrastructure?" but "how do we run it safely at scale?" Kubernetes-native deployments with proper resource limits, network policies, and secrets management are becoming the target architecture for teams that want OpenClaw integrated into production workflows rather than just running on someone's laptop.

The Alpine Linux fix in today's release directly supports this pattern. Alpine is the default base image for many production container deployments because of its small footprint and security posture. Having a broken Alpine installer was a silent blocker for container-first deployment strategies.

Wikipedia Coverage and the State Security Angle

OpenClaw's Wikipedia article has been updated to note that in March 2026, Chinese authorities restricted state-run enterprises and government agencies from running OpenClaw AI apps on office computers over security concerns. The entry also references a consent-related incident from February 2026 involving OpenClaw and MoltMatch.

The state restriction angle is worth watching. It follows a pattern we've seen with other productivity AI tools: governments that are wary of data flows and AI capabilities start restricting enterprise usage before individual usage, as the enterprise risk surface is clearer and more visible to regulators. Whether the restrictions reflect genuine security concerns about the tool or broader geopolitical dynamics around U.S.-origin AI software is an open question — but the precedent is meaningful.

Community Trust Signals: The Plugin SDK Era Begins

With the defineToolPlugin typed plugin SDK that landed in v2026.5.19, the project has crossed a threshold: it's now significantly easier to build a well-typed, declaratively described OpenClaw plugin than it was six months ago. The community is starting to ship real plugins rather than just skills.

The distinction matters. Skills are essentially SKILL.md prompt bundles that guide agent behavior. Plugins are code — they run in the gateway, declare typed tool interfaces, and can implement arbitrary logic. The security surface of plugins is much larger, and the community is just beginning to grapple with what that means for trust and moderation at scale.

ClawHub's VirusTotal scanning covers skills today. Whether and how it extends to plugins will be a defining architectural question for the platform over the next few releases.

🌐 Ecosystem News

Multi-Agent AI Goes Enterprise-Grade: The Week in Orchestration

The broader AI agent framework landscape this week continued its rapid professionalization. A summary of the May 19-25 multi-agent news from Suprmind confirmed that Microsoft moved multi-agent orchestration to general availability in Copilot Studio, announced in March 2026 and now fully rolling out to enterprise customers. Multi-agent support for Microsoft Fabric is now live as well — Copilot Studio agents can directly operate on Fabric datasets and pipelines.

At CamundaCon, Camunda announced ProcessOS, an AI-powered intelligence layer that discovers, re-engineers, and continuously optimizes business processes as agentic workflows, now in closed beta starting May 20, 2026. This is a direct validation of the pattern OpenClaw has been pioneering at the personal scale: AI agents that don't just answer questions but actively manage and improve processes over time.

A Reddit thread tracking 47 new agent products launched in 2026 made the rounds this week, noting that the 2026 wave ships with "much higher day one reliability" than the first generation of agents. The key differentiator cited: real tools, real integrations, and real failure handling — rather than impressive demos that fall apart in production. OpenClaw's reliability work over the past month fits this trend exactly.

Google's Gemini 3.5 and Gemini Spark Enter the Agent Race

LLM news this week confirmed Google unveiling its Gemini 3.5 model and the Gemini Spark AI agent. Gemini Spark is positioned as a 24/7 ambient agent — Google's most direct statement yet that the ambient AI category is where they're competing hardest. The pairing of a new frontier model with a persistent agent product is notable: Google is now playing the same vertical integration game that OpenClaw plays, just at cloud scale.

For OpenClaw operators, the Gemini 3.5 release is practically relevant: if OpenClaw supports the Gemini API, the new model should become available through the existing provider configuration. OpenClaw's model-provider architecture is specifically designed to be model-agnostic, so new frontier models typically become available without requiring an OpenClaw update.

OpenAI's IPO Filing and What It Means for the Ecosystem

OpenAI's confidential IPO filing, targeting a September public offering at a valuation that would make it one of the largest technology listings in history, is the backdrop against which everything else is playing out. For OpenClaw operators, the near-term implication is straightforward: OpenAI API pricing and terms are unlikely to change dramatically pre-IPO, but post-IPO, public market pressures will inevitably push toward profitability — which typically means API price pressure for enterprise customers.

This is exactly the argument for building agent workflows that aren't entirely dependent on a single frontier model provider. OpenClaw's multi-provider architecture — supporting Anthropic, Google, xAI, local Ollama models, and others alongside OpenAI — is not just a feature; it's a hedge against vendor lock-in in an increasingly volatile API pricing environment.