OpenClaw Extended-Stable 2026.9.33 Backports October Fixes as Beta.4 Hardens Updates and Tlon Auth
The September extended-stable line arrived overnight with the update, Doctor, restart, and model fixes that landed across October, giving conservative fleets a supported landing spot that is not the newest stable tag. Beta.4 continues the 2026.10.5 cycle with more update hardening and a Tlon security fix worth reading even if you never run betas.
Extended-Stable 2026.9.33 Brings October's Fixes to the September Line
The OpenClaw v2026.9.33 extended-stable release notes on GitHub went up at 3:39 AM Pacific today. The notes describe a gateway-only extended-stable release that the project calls its current equivalent to LTS: OpenClaw as it stood at the end of September 2026, plus critical security updates, reliability and performance fixes, and selected features such as new model support. At release time the newest regular stable version remained 2026.10.3, so 9.33 is a deliberate step behind the front of the line, not a replacement for it.
That positioning comes from the OpenClaw blog post introducing extended-stable releases and the maturity scorecard, published in July. It describes extended-stable as long-lived channels with extended support and backported fixes, rolling out monthly. Each month's line starts at YYYY.M.33, backported fixes bump the patch number by one, and a release stays supported until the next extended-stable release is cut, for at least one month. The blog frames these releases as a step toward official LTS support for teams running critical workloads.
What 9.33 carries back
The highlights read like a digest of the past two weeks of OpenClaw news, scoped to the September codebase. Upgrades on the 2026.9 line now keep state, plugin data, service ownership, and Windows state paths intact, and they refuse an automatic restore over Doctor writes that cannot be attributed (#160167, #166755). Updates finish on pnpm, npm, and Windows: pnpm 12 Gateway services and launchers survive native updates, retained updater runtimes stop blocking npm recovery, and Windows updates no longer roll back after Doctor rechecks driver ancestry (#170003, #170131, #170170, #169563).
Restart durability is backported as well. Interrupted automation turns, steered sessions, cloud worker claims, and partial worker replies now resume or persist after a Gateway restart (#170162, #170252, #170161, #170223). Model support comes along too: Meta Muse Wonder, MiniMax M3.1 Flash Preview with its thinking effort levels, and MiniMax portal OAuth sign-ins that stay valid past token expiry (#170232, #160089, #160459). Further down, the fixes list adds a Gateway responsiveness repair for long streamed replies that begin with a reply tag (#166782), Tailscale Serve handling that keeps local access when the tailnet denies Serve, and a Doctor change that never deletes an OAuth profile just because the legacy auth store is unreadable (#170256).
There is also a dedicated section for anyone updating from 2026.8.35, which by the blog's numbering sits on the August extended-stable line. Cron jobs approved with "allow always" keep running unattended after the update, pnpm 12 services left on a deleted store generation are rewritten to the durable install link, Doctor defers optional checks so older updaters' time limits are not exceeded, and Kubernetes pods run Doctor before starting (#171816). A release-check change (#171565) now qualifies extended-stable candidates for upgrades from the previous extended-stable release. The audited contribution record counts 65 pull requests in range starting from v2026.9.9.
This is the release regulated and change-averse clients have been waiting for. If your change board only approves vetted baselines, 9.33 gives you most of October's upgrade, Doctor, and restart hardening without adopting every new surface in 10.3. Teams on the August line should note the support policy: a line is supported until the next one is cut, so plan the move to 9.33 now rather than drifting.
How to move a host onto the channel
The blog gives two commands. npm install -g openclaw@extended-stable installs the release but does not persist the channel; openclaw update --channel extended-stable persists it for new or existing package installs. The OpenClaw updating guide's channel section adds detail that matters in practice. The extended-stable channel is package-only, installs run in the foreground, and OpenClaw reads the public npm extended-stable selector, verifies the exact package, and installs that version. Missing or inconsistent registry data stops the update rather than falling back to latest, and extended-stable does not accept --tag.
One detail deserves a line in every runbook: if the selected version is older than what is installed, the normal downgrade confirmation still applies. A host already running 10.3 that switches to extended-stable would be moving backward to 9.33, so preview the change with openclaw update --dry-run and check openclaw update status --json before committing. After the core swap, eligible official plugins with default or latest intent converge to the exact core version, while third-party plugins and explicit pins keep their existing behavior.
2026.10.5-beta.4 Keeps Hardening Updates and the Gateway
The OpenClaw 2026.10.5-beta.4 prerelease notes on GitHub were published at 11:10 PM Pacific on October 14 and cover 61 pull requests since beta.3; the npm package is [email protected]. Update reliability leads again. macOS updates no longer time out on aliased temporary directories, systemd user installs reclaim abandoned runtimes, pacman and FreeBSD package installs are left to their own package manager, snapshot failures are identified before activation with accurate recovery advice, and success summaries stop listing settled plugin upgrades as pending.
Two user-facing fixes stand out. ChatGPT-listed models no longer fail before sending any request on the default Codex runtime (#168033), and headless browser pages keep accepting clicks and key presses while a site waits for a passkey, so headless sign-ins stay usable (#170857). The turns section preserves interrupted turns when new messages arrive, keeps ACP follow-up replies from disappearing after the previous turn is stopped, and lets Claude CLI sessions remember announced sub-agent results on the next turn. Gateway lifecycle work covers recovery of state ownership after sleep and clock changes, shutdown that is no longer blocked by stalled transcript workers, and a fix for Android and Termux gateways that failed with a "shared-state database generation changed" error.
Comparing the two sets of notes shows the backport pipeline at work. Several fixes in today's beta, including the reply-tag streaming repair (#166782), the Tailscale Serve local-access fix (#171509), the blocked-turn log noise fix (#167595), and the failed-state-cleanup read fix (#171709), also appear in 9.33. Watch note: the nested-effect Doctor fix tracked as #168750 and #170070 is still absent from the stable 10.3 notes, and neither number appears in the 9.33 notes, so keep openclaw update repair handy on those lines.
Beta.4 is the build to stage if your fleet mixes macOS laptops, Linux systemd hosts, and headless browser automation, because that is exactly where its fixes land. Give it a disposable Gateway, run a full update cycle, and exercise a passkey-gated sign-in. Keep production on 10.3 or 9.33; nothing here argues for running a prerelease on client systems.
Security Practice: Owner Commands Belong in a 1:1 Tlon DM
Beta.4 stops Tlon group DM authors from acting as the owner
The beta.4 security entry is short: Tlon never treats group DM authors as the owner (#165801). The OpenClaw Tlon channel documentation explains why. Tlon does not verify who wrote a group DM message, so group DM messages never carry owner authority. Owner commands, approval replies, and admin commands work only in a 1:1 DM with the bot, and a group DM from a ship on dmAllowlist is answered as an ordinary unverified sender. Pending DM requests saved by older versions cannot be told apart from group DM claims; approving one still adds the ship to the allowlist, but its stored message is not replayed.
The fix is listed in a prerelease. Neither the 10.3 nor the 9.33 notes mention #165801, so operators on stable lines should not assume they already have this protection.
- Set
channels.tlon.ownerShipto your own ship. The owner is authorized everywhere, and unauthorized requests queue for approval instead of being silently dropped. - Keep
dmAllowlistshort; an empty list admits no DMs except from the owner. Leave group authorization at itsrestricteddefault and useauthorization.channelRulesfor any channel you open up. - Issue approvals and admin commands only in a 1:1 DM, and treat anything in a group DM as unverified input, whatever name it claims.
- Check drift with
openclaw security auditand compare against the hardened baselines in the OpenClaw Gateway security documentation, which notes that Tlon relies on the allowlist and owner approval flow rather than pairing codes.
The broader lesson applies to every channel: authority should come from a verified identity, never from a display name inside a shared conversation.
Ecosystem Tool: CLI-Anything Turns Desktop Apps Into Agent CLIs
HKUDS/CLI-Anything: generated command lines plus SKILL.md for real software
The CLI-Anything repository from HKUDS on GitHub pitches itself as a way to make desktop and backend software agent-native. It has two entry points. CLI-Hub (pip install cli-anything-hub, then cli-hub install <name>) installs ready-made, community-built CLIs for tools such as GIMP. A generator runs a seven-phase pipeline (analyze, design, implement, plan tests, write tests, document, publish) to build a Click-based CLI with a REPL, JSON output, and undo/redo, and every generated CLI ships with a SKILL.md agents can discover.
OpenClaw support is community-maintained: the README says to copy openclaw-skill/SKILL.md into ~/.openclaw/skills/cli-anything/ and then ask the agent to build a CLI for a target such as ./gimp. The project is Apache 2.0 licensed, and the README claims 2,461 passing tests. It also warns that many CLIs wrap real applications such as GIMP, Blender, or LibreOffice, which must be installed separately.
This is not an official OpenClaw skill. Generated harnesses drive local software with the permissions of whatever runs them, so review the generated code before enabling it, run it in a sandboxed agent profile first, and install by repository owner rather than by search result.
Community: ClawCast Episode 13 and Open Together in San Francisco
ClawCast Episode 13, "How to Use OpenClaw in Your Small Business", recorded October 14, runs just over an hour. Hosts Hannes Rudolph and Patrick Erichsen talk with PJ Standley, who started with his family's pest-control business and now helps local businesses adopt OpenClaw, and with Graham McBain. PJ's method is to connect the tools a business already uses, watch which work people repeat, and turn useful routines into skills, with examples spanning proposals, bid calculations, email and calendar briefings, and pulling leads from several sources into one place. Joe Pishgar then introduces the OpenClaw community forum, and the episode closes on skill search and model catalog improvements. The official @openclaw post announcing ClawCast Episode 13 went out at 5:53 PM Pacific yesterday.
Separately, the @openclaw invitation to Open Together with Hugging Face points to a free kickoff for Open Source AI Week this Friday, October 16, at The Midway in San Francisco. The Open Together event page on Luma lists OpenClaw among the hosts, with a meetup and community demos from 6 to 9 PM followed by a dance party until midnight.
PJ's playbook matches what we see with SEN-X clients: the wins come from observing repeated work and packaging it as skills, not from big-bang automation. His goal of making clients self-sufficient is the right one. Pair that with today's release choice, extended-stable for the business-critical Gateway and betas only on a test box, and a small team can run OpenClaw without a dedicated platform engineer.
Need help choosing an OpenClaw release channel?
SEN-X helps teams plan extended-stable rollouts, channel guardrails, permission boundaries, and staged beta testing.
Contact SEN-X →