OpenClaw Readies 2026.10.9 and 2026.9.36 Patches as a Preprint Finds 612 Unsafe Chains Among Clean ClawHub Skills
Release branches for a 2026.10.9 stable patch, a 2026.9.36 extended-stable patch and 2026.10.10-beta.5 filled with dependency security fixes overnight, though nothing is tagged yet. Also: the KnotScryer skill-composition preprint, Knowledge sharing for group chats, upgrade guards on main, four OpenClaw developers in the Linux Foundation's Top 100, and the gog skill.
Three Patch Releases Take Shape Overnight, With No Tags Yet
There is still no new OpenClaw release this morning. The OpenClaw releases page on GitHub still lists 2026.10.8 as the newest stable release, 2026.9.35 for extended-stable and 2026.10.10-beta.4 for beta, and the npm channels match. But the release branches filled up overnight with backports from maintainer Dallin Romney, and all three lines now carry new version numbers. The release/2026.10.9 branch declares version 2026.10.9, release/2026.10.10 declares 2026.10.10-beta.5, and the extended-stable branch declares 2026.9.36.
The draft 2026.10.9 changelog on the release branch, refreshed at 4:01 AM Pacific on Thursday, calls it a maintenance release focused on "security dependency patches, recovery, data preservation, and reliability fixes," built from 48 pull requests. Its highlights:
- fast-uri 4.2.3 rejects malformed URI schemes and hosts during MCP schema validation. The fast-uri backport to the 2026.10.9 branch, pull request #187284, says external MCP tool schemas reach that parser and cites four GitHub advisories. It also says no unauthenticated network exploit is claimed.
- Oversized Zod collections are rejected early in A2UI and in the Zod copy bundled inside Discord's embedded app SDK. IMAP sender parsing moves to nodemailer 10.1.4 so spoofed senders cannot pass the sender token gate, and Microsoft Teams moves to a patched MSAL Node.
tools.fs.workspaceOnlynow also applies to tools the Gateway builds itself, so delegate changes still need approval and media tools stay inside the workspace.- Failed update rollbacks no longer reset operator edits in Git checkouts or strand npm installs, and agents can recover from a full disk without a restart.
The extended-stable line got there first in one sense. Pull request #187566 preparing the 2026.9.36 extended-stable patch, merged at 6:20 AM Pacific, bumps the version and adds notes covering 28 pull requests, while stating that "Nothing is published by this PR." Besides the same dependency fixes, the draft 2026.9.36 changelog on the extended-stable branch includes a Teams fix: name-keyed teams or groupAllowFrom entries that fail to resolve "now grant nothing instead of opening the bot to every team or group." It also carries the eMudhra trust remediation from pull request #186639. Yesterday we quoted that backport's own description, "not a version bump or authorization to publish a release"; it now has a version to ship in.
The beta line picked up a practical fix. Pull request #187626 bringing the relaxed Node policy to 2026.10.10-beta.5 says release validation caught the live installer accepting Homebrew Node 24.22.0 while the beta package refused anything below 24.22.1. The beta now follows main's warn-instead-of-refuse policy, which we covered yesterday. The docs.openclaw.ai release pages for 2026.10.9 and 2026.9.36 returned "not found" when we checked, so treat the branch notes as drafts.
Nothing here is installable yet, and none of it should be pulled from a branch. Use the wait to check exposure. Teams deployments with name-keyed allowlists on 2026.9.x should confirm every entry resolves, IMAP channels should get the sender-parsing fix soon, and anyone relying on tools.fs.workspaceOnly should retest it after upgrading.
A Preprint Finds 612 Unsafe Chains Among Clean ClawHub Skills
The most useful security reading this week is not about any one bad skill. The KnotScryer preprint on insecure compositions of clean agent skills, by Yihao Li and five co-authors and posted to arXiv on October 23, argues that individually benign skills can be chained by the agent into a violation. One skill pulls in attacker-influenced content, the agent passes it along, and a second skill performs the dangerous action.
The authors took every skill labeled clean in a May 18, 2026 ClawHub snapshot, 13,598 in all, and found 612 high-confidence violation chains. According to the full text of the KnotScryer paper, those chains were exploited at an average rate of 79.2% across three agent frameworks and three models (Claude Sonnet 4.6, GPT-5.5 and GLM-5.1), with each chain getting at most two attempts per agent. The OpenClaw version tested was 2026.6.8, which scored 71.7% overall, ranging from 51.1% with GPT-5.5 to 92.3% with Sonnet 4.6. When the team checked the 612 chains against Cisco AI Defense's single-skill scanner, 84 chains, or 13.7%, were made entirely of skills that scanner marked safe.
The examples are ordinary pairings. One combines a GitLab inspection skill with a deploy skill that installs and runs a project, so instructions planted in a public issue can lead to code execution on the agent's host. The end-to-end case study pairs an Outlook reader with a cold-email sender to leak audit figures to an attacker's inbox. The authors say they disclosed the chains to the skill platform and that all tests ran on a local network. We found no public response from ClawHub. This is a preprint, the snapshot is five months old, and it tested a June OpenClaw build, so treat the rates as directional.
This changes how to review skills more than which skills to trust. A per-skill Pass answers whether a skill is malicious, not what it can do next to the others you installed. List each agent's skills in two columns, those that read outside content and those that send, write or execute, and be wary of any agent that holds both.
On Main: Group Chats Can Be Granted an Agent's Private Knowledge
On Monday we covered Knowledge memory arriving on main, off by default. It has a sharing control now. Pull request #186455 letting owners grant group chats access to private knowledge, merged Wednesday at 7:26 AM Pacific, lets an operator admin give a group or channel conversation read access, or read and save access, to its agent's private knowledge from Knowledge settings. Threads inherit the grant. There is deliberately no save-only grant, because save results could reveal private records to a chat that cannot read them. Revoking a grant sends the conversation back to its own partition and fails work in flight at its next authority check, though the pull request concedes that a save already past its last check can still land. It merged after every current tag, so it is on main only.
On Main: Upgrades That Refuse to Break a Running Gateway
Two user reports about broken upgrades produced direct fixes on Wednesday, alongside a third crash fix. Pull request #186971 stopping a newer CLI from migrating state an older Gateway still runs handles a common trap: a global npm install under a different Node leaves a newer CLI beside an older managed Gateway, and even a routine config write could migrate shared state forward so the Gateway would not start. The CLI now refuses and names both versions. Pull request #187192 making Doctor fail loudly when work was skipped fixes openclaw doctor --fix reporting success on malformed config; automation now gets exit code 2 when Doctor cannot inspect and 1 when a migration is left deferred. And pull request #187083 recovering queued messages after a Gateway crash surfaces messages that sat pending forever after a forced kill, so users can review and resend them.
One access fix landed alongside them. Pull request #185796 fencing native runtime access when a channel owner is removed closes a gap where a subagent spawned by a channel owner kept its remembered native-runtime consent after that person stopped being an owner. The child now stops before its next native dispatch.
Four OpenClaw Developers on the Linux Foundation's Top 100
OpenClaw celebrated a ranking on Wednesday evening. The official OpenClaw post on the Linux Foundation Top 100 named Peter Steinberger at No. 1, Vincent Koc at No. 7, Ayaan Zaidi at No. 33 and Dallin Romney at No. 57, with 569,649 contributions in a year and 13.8% of the Top 100 total. We checked the LFX Insights Top 100 contributors leaderboard directly. The four counts there, 421,865, 86,525, 33,152 and 28,107, add up to 569,649, which is 13.8% of the list's total. Steinberger's count is more than twice that of the No. 2 contributor. LFX ranks developers by volume of contributions over the last 12 months, so this measures activity, not impact.
On the community side, ClawCast episode 15, One Agent, Many Sessions, released October 28, has host Hannes Rudolph with Jacqueline Henriksen and Vitor Cepeda Lopes comparing one main agent with many sessions against separate agents or Gateways for privacy and restricted access. The episode notes say a recurring theme is verification: "clear goals and evidence of useful work matter more than how long an agent can keep running."
Security Practice: Split the Skills That Read From the Skills That Act
Use per-agent skill allowlists to keep risky pairs apart
The KnotScryer authors suggest one defense: keep the skills in a dangerous chain from being visible to the agent at the same time. OpenClaw already supports that. The OpenClaw skills config reference describes agents.defaults.skills as a shared baseline and agents.entries.*.skills as an explicit final list per agent that replaces the defaults rather than merging. An empty list exposes no skills.
- Give agents that read inboxes, issues, feeds or web pages their own allowlist without send, deploy or exec skills, and keep those action skills on a separate agent.
- Don't overrate the allowlist. The same reference warns it is a visibility and loading filter, "not a shell-time authorization boundary": an agent with host exec can still run external clients. Pair it with a sandbox and a tight exec policy.
- The OpenClaw security and access control FAQ recommends a read-only or tool-disabled reader agent for untrusted content and notes that ClawHub scans "are not a complete security boundary."
Skill Card: gog Puts Google Workspace Behind One CLI
@steipete/gog for Gmail, Calendar, Drive, Contacts, Sheets and Docs
Email and calendar help came up repeatedly on this week's ClawCast, and one skill dominates that category. The gog skill listing on ClawHub, published by Peter Steinberger, is at version 1.0.0 with 198,362 downloads and 956 stars. It wraps the gog binary for Gmail search and send, calendar events, Drive search, contacts, Sheets and Docs export, needs one-time OAuth setup, and tells the agent to "Confirm before sending mail or creating events." Several other accounts publish skills with the same gog slug, so install it by its full @steipete/gog reference.
The CLI now lives in the gogcli repository under the OpenClaw organization, MIT-licensed, with v0.47.1 released October 26 Pacific. Its README offers --readonly, exact command allowlists via --enable-commands-exact, a --gmail-no-send policy and --wrap-untrusted output, plus narrower Gmail scopes such as --gmail-scope read-send. Note that the skill's install metadata still names the steipete/tap Homebrew formula, while the README now uses openclaw/tap/gogcli.
gog is the KnotScryer pattern in one skill: it reads untrusted mail and can send mail. That is why its safety flags matter. For an agent that triages an inbox, authorize only the scopes it needs and run gog with --readonly or --gmail-no-send, then leave sending to a separate agent that waits for your approval.
Auditing which skills your agents can combine?
SEN-X helps teams map each OpenClaw agent's skills, split readers from actors with per-agent allowlists, and plan 2026.10.9 or 2026.9.36 rollouts across a fleet.
Contact SEN-X →