OpenClaw Drops Its One-Day-Old Security Presets as the Control UI Learns to Keep Working Offline
OpenClaw's main branch added personal and corporate security presets on Tuesday and removed them Wednesday morning, while the browser Control UI learned to survive dead connections. Also: a relaxed Node floor, a firmer 2026.10.8 count, LFM3 for local agents, two sandbox fixes and a Quire skill.
On Main, Security Presets Arrive and Leave Within a Day
For under fifteen hours, main had a single trust switch. Pull request #185477 adding automatic busy-session messages and security presets, merged at 3:45 PM Pacific on Tuesday, October 27, introduced security.preset with two values. The pull request describes "personal" as the default trusted-operator, full-access posture, and "corporate" as selecting session sandboxes plus stricter steering and conversation-reach defaults. It also warned that corporate "is configurable, not compliance certification or hostile-tenant isolation."
At 6:19 AM Pacific on Wednesday, pull request #186381 removing the personal and corporate security presets took the selector back out, so each policy area is configured independently again. It says permissive host execution and default-on collaborative steering remain the defaults, and that stricter controls remain opt-in. Neither change is in a release. Anyone who tried the preset on a main build must remove security.preset before the Gateway will start; openclaw doctor --fix does that with a backup, but restrictions the preset supplied are not kept.
The busy-session handling stays: a message sent mid-turn steers the running turn when it can, and otherwise queues quietly as its sender's own turn instead of being refused. The OpenClaw steering queue guide says messages.queue.allowCollaborativeSteering defaults to true: when Bob's message joins Alice's running turn, the execution keeps Alice's identity and prepared permissions, so Bob can influence actions using permissions that Alice has and he does not. Setting it to false queues the other person's input as their own turn.
The presets are gone, but the question they tried to answer is still there. If several people share agent conversations and hold different permissions, decide on allowCollaborativeSteering before this behavior reaches a release; false keeps each person's input under their own identity. Write sandbox and steering settings out explicitly rather than waiting for another policy bundle.
The Control UI Learns to Ride Out a Dead Connection
Maintainer Peter Steinberger has been making the browser Control UI work without a network. Pull request #174043 keeping the Control UI usable offline, merged October 16, made the service worker fall back to its cached shell for app routes whenever a request fails, not only when the browser reports itself offline. Pull request #182336 precaching deferred chunks for offline actions, merged October 24, lets actions such as queued sends and renames load offline.
Pull request #186325 recovering quickly when spotty connections return, merged Tuesday at 3:20 PM Pacific, says the UI could stay disconnected for tens of seconds after airplane Wi-Fi came back. Disconnected tabs now probe a health endpoint every two to three seconds and, in the measured scenarios, reconnect within a few seconds. Pull request #186342 preventing hidden-run read floods after reconnecting batches subagent read acknowledgements so a reconnect does not flood the Gateway, and pull request #186630 allowing a typed Stop while reconnecting lets /stop work during an outage. None of these appears in the 2026.10.8 notes, so expect them in a later release.
The OpenClaw design note on earlier warm transcript display is frank about the cost: anyone with the browser profile or disk access can read retained transcript text.
An offline-capable Control UI is good news for anyone who supervises agents from trains, planes or patchy hotel Wi-Fi. The cost is that conversation text now lives in the browser profile. Treat any profile that has opened the Control UI as holding sensitive transcripts, and keep it off shared or unmanaged machines.
Main Stops Refusing Updates on Older Node, but Still Wants the Patch
Since 2026.10.6 and 2026.9.34, OpenClaw has required Node 24.22.1 or 26.12.1, the releases that reject keys from the October eMudhra compromise. Pull request #186589 keeping updates working below the recommended Node security patches, merged at 12:44 AM Pacific on Wednesday, says that floor caused updates to be refused on Node versions that met the older requirement. Main now accepts Node 24.16.0 or later on the 24 line and 26.1.0 or later. Updates, Doctor and openclaw security audit warn prominently below the patched versions instead of refusing.
The OpenClaw Node.js compatibility reference lists the change as "Unreleased (main)". The OpenClaw security CLI reference adds a limit: the new runtime.node_security_patch finding checks the Node running the audit, not a Gateway service that runs under a different executable. Separately, pull request #186639 backporting eMudhra and Docker repairs to extended-stable, headed as the required 2026.9.36 backports, says it is "not a version bump or authorization to publish a release." No 2026.9.36 tag exists yet.
A looser floor makes updates less brittle, but it does not make an old Node safe. When this ships, do not read a successful update as a clean bill of health. Check the Node version your Gateway service actually runs, since the audit only sees its own runtime, and move hosts to 24.22.1 or 26.12.1.
Release Check: No New Tag, and a Firmer 2026.10.8 Count
No new release appeared overnight. The official @openclaw post saying the v2026.10.8 patch is out, at 3:08 PM Pacific on Tuesday, refers to the release we covered yesterday. The OpenClaw docs release notes for v2026.10.8 now give its scale as 161 pull requests, 28 direct commits and 163 contributors. Our October 27 report used the GitHub notes' provisional count of 162.
Liquid AI's LFM3 1.7B Is Post-Trained for OpenClaw
The Liquid AI announcement introducing LFM3, dated October 27, says its LFM3-1.7B text model is post-trained for agent harnesses including Hermes Agent, Pi and OpenClaw, with a 256K-token context window and about 1 GB of memory at 4-bit precision. Its LFM3-1.7B model card on Hugging Face advises against using it for agentic coding or complex multi-step reasoning.
Security Practice: Check Sandboxed Children and the nodes Tool
Two 2026.10.8 fixes close quiet routes around sandbox and tool policy
The GitHub release notes for openclaw 2026.10.8 list two fixes we did not cover yesterday. Pull request #178742 failing closed when sandboxed children resolve CLI-backed models explains that sessions_spawn decided containment before the child's model was resolved. A sandboxed child whose model routed to a host-executed CLI backend such as claude-cli therefore ran on the Gateway host as the Gateway's OS user, while diagnostics still reported it as sandboxed. Those spawns now return forbidden. Pull request #179880 refusing browser proxy commands on generic nodes invoke fixes a gap where an agent denied the browser tool could still drive a paired node's browser through a raw node.invoke call.
- Move to 2026.10.8. Spawns that put a sandboxed child on a CLI backend will now fail; switch that child to an API-backed model or change the sandbox policy deliberately.
- Run
openclaw sandbox explain, described in the OpenClaw guide to sandbox, tool policy and elevated exec, to confirm which sessions really are sandboxed. - The OpenClaw tool policy reference puts
nodesandcomputeringroup:nodes. If an agent has no need for paired devices, deny that group alongsidebrowser. - Before installing a third-party skill, read its status under the ClawHub security audits guide, which treats Pass as reassuring but not a guarantee. For a second opinion, the Agent Supply-Chain Auditor repository added a scanner on Tuesday that flags look-alike skill names such as
openclaw-coreand prompt-injection patterns. It is a new one-person project, so treat it as an extra check, not a verdict.
Skill Card: Quire Lets an Agent Keep a Project Board Current
Quire tasks and comments through the quire CLI
Quire promoted its skill on Tuesday in an official Quire post announcing its OpenClaw skill. The Quire skill listing on ClawHub, published by Quire's organization account, has existed since May and is at version 0.3.1 under MIT-0, with seven versions, 887 downloads and a clean moderation verdict. The skill reads tasks, comments, projects, statuses and tags, and supports exactly six writes: create, update, set dates, complete, reopen and comment. It needs the quire binary on the Gateway host.
Install it with openclaw skills install quire. The Quire CLI repository covers installing the CLI and running quire login once. The Quire API documentation for the CLI notes that the authorization screen lets you choose which organizations and projects the CLI may reach, and that quire logout does not revoke the server-side token; remove the app at quire.io/apps for that.
Quire is a tidy example of a vendor-maintained skill: narrow writes, no API keys in agent config, and a clear list of what it will not do. When you run quire login on a Gateway host, grant only the projects the agent needs, and remember that logging out locally does not cut off its access.
Setting OpenClaw policy without presets?
SEN-X helps teams write explicit sandbox, steering and tool policies for OpenClaw, verify sandboxed agents after upgrades, and plan Node patching across a fleet.
Contact SEN-X →