OpenClaw Ships on NVIDIA RTX Spark Windows Laptops as Long-Patched August Security Fixes Receive CVE Records
NVIDIA's RTX Spark launch names OpenClaw among the agents users can set up without a command line, and @openclaw confirmed guided setup with a local model or a cloud provider. Meanwhile, ten CVE IDs now cover fixes OpenClaw shipped in August, so update any host still older than 2026.8.1.
OpenClaw Arrives Out of the Box on NVIDIA RTX Spark Laptops
NVIDIA's October 16 launch release, "NVIDIA RTX Spark PCs Available Today — A New Beginning for Windows PCs" on the NVIDIA Newsroom, names OpenClaw directly. Its "From Tool to Teammate" section says guided setup and easy installers help users get started with agents, "including GitHub Copilot, Hermes, OpenClaw, Perplexity, Pi and WorkBuddy, without requiring a command line." NVIDIA describes RTX Spark as a superchip pairing a Blackwell RTX GPU with a Grace CPU and up to 128GB of unified memory, in laptops from ASUS, Dell, HP, Lenovo, Microsoft, and MSI starting at $2,599.
OpenClaw confirmed its side of the launch in the official @openclaw post on setting up OpenClaw out of the box on RTX Spark laptops, sent at 1:21 PM Pacific on October 16. The post says users can choose a local model or connect a cloud provider and follow the guided setup without opening a terminal, and thanks the NVIDIA and Microsoft teams. Later that evening the @NVIDIARTXSpark recap of six launch-city events thanked attendees of "Build-a-Claw" sessions across Seoul, Taipei, Beijing, Berlin, Istanbul, and San Francisco.
The release also says the NVIDIA OpenShell secure runtime and Microsoft Execution Containers help users control agent permissions, and that NVIDIA agent skills let compatible agents drive Broadcast, RTX Remix, and Omniverse libraries. It does not say which skills OpenClaw supports at launch, so check that on the device.
With NVIDIA naming OpenClaw as a day-one, no-terminal install, more first-time users will run a Gateway. That changes who runs one. The new owner of an RTX Spark laptop may never read a config file. Teams handing these machines to staff should decide the model choice, channel list, and approval policy before the guided setup does it for them.
What the OpenClaw Docs Say About Windows and Local Models
We found no RTX Spark-specific OpenClaw docs page, so the general Windows guidance applies. The OpenClaw Windows platform documentation for Windows Hub, Tauri, and WSL2 names the native Windows Hub as the recommended desktop app. It ships signed x64 and ARM64 installers, needs no administrator rights, and its Set up locally path provisions an app-owned OpenClawGateway WSL distro. Privacy-sensitive node commands such as screen.record and camera.snap need an explicit gateway.nodes.commands.allow opt-in.
For the local-model half of the @openclaw post, the OpenClaw local models guide on hardware-aware setup describes a managed path through the llama.cpp plugin, with LM Studio and Ollama available for people who manage the model themselves. It also warns that local models lack hosted providers' safety filters, so tool permissions and prompt-injection defenses must fit the model and the task. If agents should run inside NVIDIA's runtime, the OpenClaw OpenShell sandbox backend documentation covers installing @openclaw/openshell-sandbox, setting sandbox.backend to openshell, and confirming the result with openclaw sandbox explain.
Unified memory makes larger local models practical on a laptop, but the OpenClaw docs are explicit that a local model gives you no hosted safety layer. On a new RTX Spark machine, pair any local default with a sandbox backend such as OpenShell and a short tool allowlist. Then run openclaw security audit --deep before you connect a public messaging channel.
Long-Patched August Fixes Now Carry CVE Records
Automated CVE feeds on X reposted a batch of OpenClaw CVE IDs on Friday evening. Checked against the primary records, the vulnerabilities are not new. In the National Vulnerability Database, records such as NVD entry CVE-2026-100561 for the OpenClaw exec wrapper approval bypass and NVD entry CVE-2026-100543 for redacted config hashes acting as password verifiers were published on September 26 (UTC) by VulnCheck as the assigning authority, and NVD currently marks them "Deferred." All ten IDs we checked (CVE-2026-100543, -100544, -100551, -100552, -100555, -100557, -100558, -100559, -100560, and -100561) describe issues fixed in 2026.8.1, except the iOS Control UI TLS-pinning gap, which was fixed in 2026.8.11. VulnCheck's CVSS base scores for the set range from 7.1 to 9.0.
The issues themselves were disclosed weeks earlier. OpenClaw's own GitHub security advisory GHSA-ghpx-6xwq-2w4w on exec wrapper allowlists trusting arbitrary inner commands and advisory GHSA-qgj5-6x35-9g6f on config revision hashes exposing password verifiers were published on September 10 at 5:58 PM Pacific, both rated high and both naming 2026.8.1 as the first patched stable version. The other NVD descriptions include skill tool dispatch dropping the sender's owner status, inbound voice calls inheriting owner tool authority, escaped newlines confusing exec allowlist parsing, and Allow Always grants persisting as path-only approvals.
For background, OpenClaw's Josh Avant pointed people on X to the OpenClaw blog recap of the Trail of Bits security audit, published September 21. It counts 24 severity-rated reports (0 Critical, 2 High, 16 Medium, 6 Low), says every actionable issue has been repaired, and names its most common lesson: permissions must follow the request. That theme runs through most of the CVE descriptions above.
New CVE IDs are not new bugs, but scanners and compliance tools will start flagging any OpenClaw install older than 2026.8.1. Any Gateway on the current 10.x stable line already includes the fixes for all ten. The real risk is forgotten hosts, such as a demo VM or a lab Mac, still running a July build. Inventory versions now so a scanner report doesn't turn into a fire drill.
Security Practice: Audit Standing Approvals for Command Wrappers
Wrapper approvals were the root of GHSA-ghpx-6xwq-2w4w (CVE-2026-100561)
The advisory explains the failure mode. After an operator allowlisted or permanently approved a harmless invocation of a command-running wrapper, a later agent turn could swap in an arbitrary inner command without another prompt. Shell carriers, process monitors, and tracing wrappers were affected. The mitigation advice still applies after patching: remove standing approvals for wrappers, avoid allowlisting wrapper executables for arbitrary arguments, and require per-invocation approval for shell carriers, monitors, tracers, namespace tools, and proxy wrappers. The OpenClaw approvals and exec-policy CLI reference documents today's behavior: for exec requests, allow-always means "always allow here," tied to the command's exact arguments and current working directory.
- Run
openclaw exec-policy show --agent main --verboseto see the effective terminal policy for each agent. - Review allowlist entries and remove any wrapper binaries with
openclaw approvals allowlist remove. - For automation approvals, mint expiring grants with
openclaw approvals resolve <id> allow-always --expires-in-days 30instead of open-ended ones. - Confirm every Gateway reports 2026.8.1 or later, and every iOS node runs 2026.8.11 or later.
An approval should cover the command you reviewed, not the program that launches it.
Ecosystem Tool: Managed llama.cpp Local Models
The llama-cpp provider plugin (@openclaw/llama-cpp-provider)
The OpenClaw llama.cpp provider documentation for managed and existing servers describes the plugin behind the "choose a local model" path. Install it with openclaw plugins install @openclaw/llama-cpp-provider, run openclaw onboard, and choose Managed local server. Setup reads the Gateway host's memory, GPU, and disk, shows the model and download size before downloading, verifies pinned files, and only saves the default after the model reads a temporary file through an OpenClaw tool. Curated recipes run from Qwen3.5 4B (8 GiB floor) to Qwen3.8 27B (32 GiB with GPU acceleration).
One caveat for the new hardware: the docs' execution-backend table lists CUDA 12.4 for Windows x64 with a supported NVIDIA GPU, but CPU for Windows arm64. NVIDIA's release describes RTX Spark as Grace-CPU based and cites the first PyTorch-CUDA build for Windows on Arm. If your laptop reports Windows arm64, expect the managed recipe to run on CPU unless the RTX Spark installer handles it differently, which we could not confirm in the docs; for GPU serving, the docs suggest running your own compatible server and choosing Existing llama-server.
Release Watch: No New Tag, and the Doctor Fix Is Still Beta-Only
The OpenClaw releases page on GitHub shows no new tag since yesterday's coverage. Stable 2026.10.4 (October 15, 5:36 PM Pacific) and 2026.10.10-beta.1 are still the newest. On the nested-effect Doctor failure, pull request #170070 fixing nested-effect failures during chat update cleanup merged on October 12 at 12:21 PM Pacific and closed issue #168750 on update activation Doctor failing with a nested effect. A GitHub compare shows the merge commit in the 10.10-beta.1 history but not in the 10.4 tag, and no 10.3-to-10.4 commit carries the fix. Operators who hit #168750 should keep openclaw update repair handy until a stable tag names #170070.
A quiet release day is a good day for housekeeping. Move production Gateways to 10.4, record each host's version for the CVE scanners, and keep 10.10-beta.1 on disposable machines. New RTX Spark laptops running the guided installer deserve the same standards as your servers.
Rolling OpenClaw onto new RTX Spark laptops?
SEN-X helps teams set approval policies, sandbox backends, local model defaults, and version inventories before guided setup reaches staff machines.
Contact SEN-X →