OpenClaw Main Lets New Claude Models Work Without a Release as Fable 5.2 Users Hit a Hidden 8,192-Token Cap
OpenClaw main now treats any Claude model it has never seen with the strictest known rules, so Claude Fable 5.2 keeps its reasoning without waiting for a release. An open issue shows the other side: a hand-configured Fable 5.2 entry was silently capped at 8,192 output tokens and failed mid tool call. A signed 2026.11.5-beta.2 tag and a fixes-only 2026.11.3 are both in the pipeline, and Acronis revived its count of 575 malicious ClawHub skills.
Anthropic's new Claude Fable 5.2 reached OpenClaw users before OpenClaw's model tables knew it existed, and the night's work shows what that costs. At 1:02 AM Pacific on Tuesday, a pull request landed on main that makes any Claude model OpenClaw has never seen work with the strictest known rules, instead of waiting for a release to add its name. Five minutes later, a user filed a bug showing that a configured Fable 5.2 entry was quietly capped at 8,192 output tokens and was failing in the middle of tool calls. On the release side, a signed 2026.11.5-beta.2 tag appeared Monday evening, a 2026.11.3 patch is being prepared on its release branch, and Acronis put an old count of malicious ClawHub skills back in the headlines.
New Claude Models No Longer Wait for an OpenClaw Release
Pull request #196459 fixes new Claude models losing reasoning and hitting 400 errors until an OpenClaw release. Its author, maintainer obviyus, describes the bug plainly. Fable 5.2 sessions running through a proxy or custom Anthropic base URL got a 400 (Invalid signature in thinking block) on every tool loop and then lost their earlier reasoning. "Any Claude model released after an OpenClaw version had the same problem until a release added its name."
The fix flips the default. A Claude model ID OpenClaw does not recognize now gets "the strictest known contract": append-only runtime context, adaptive thinking that cannot be turned off, no temperature, top_p or top_k, and no assistant prefill. Older generations sit on "a closed list that only ever shrinks," and live /v1/models capabilities still override the fallback where Anthropic lists them. The hand-maintained table of which Claude model can read which model's thinking is gone. In its place is one rule: thinking from a prefix-bound model does not follow a model switch. claude-cli aliases such as fable now resolve through Claude Code's own model menu. The PR notes that Claude Code 2.1.314 still maps fable to Fable 5.1, so that alias still points at Fable 5.1. The PR's proxy captures show the custom route going from 7 rejected requests out of 18 to none out of 12.
The updated OpenClaw Anthropic provider guide now says a Claude model released after a given OpenClaw version "(such as Fable 5.2) is treated as prefix-binding without an update." Earlier, at 6:18 PM Monday, pull request #196384 added Fable 5.2 and HY4 to the curated model recommendations, citing Anthropic's Claude Fable 5.2 model overview, which lists a 1M-token context window, 128K maximum output and $8/$40 per million input and output tokens.
This is the right direction. A model provider ships a new model on its own schedule, and an agent platform that needs a release for every name will always be a day or a week behind. Defaulting unknown Claude IDs to the strictest contract trades a little flexibility for fewer broken sessions. It is on main only, so stable users routing Fable 5.2 through a proxy still need care.
The Hidden 8,192-Token Cap
The second problem is a configuration trap, and it is still open. Issue #196544 reports that a configured model without maxTokens silently gets an 8192 output cap. The reporter, alexph-dev, runs OpenClaw 2026.10.10 against Anthropic directly and had added claude-fable-5-2 under models.providers.anthropic.models only to set contextTokens. Because the 2026.10.10 catalog does not know that ID, the request went out with max_tokens of 8,192, even though Anthropic documents 128K. In one day, 12 assistant attempts failed with "Provider completed stream with an incomplete tool call," and each inspected failure stopped at exactly 8,192 output tokens. The fallback pass then ran with tools disabled, so the work in progress was abandoned.
A follow-up comment narrows it down. Over ten days on the same Gateway, Claude Opus 5.5, which is in the bundled catalog, produced 27,066 replies and none stopped at exactly 8,192. Fable 5.2 produced 133 replies, and seven did. The reporter's summary is that "the 8192 fallback applies only when the configured model id is absent from the bundled catalog," and that models.list shows maxTokens: null for both, so nothing on screen reveals the cap. The project's ClawSweeper review kept the issue open, saying current main raises the old default cap but still loses the cause when a tool call is cut off. An open fix, pull request #196587, which names the output cap when max_tokens cuts an Anthropic tool call, would change the error to say the limit was reached and to suggest raising maxTokens.
The workaround the reporter verified is simple: set "maxTokens": 128000 on each such entry, and the config hot-reloads. The OpenClaw custom providers configuration reference also documents models.providers.*.maxTokens as a provider-wide default for entries that leave it unset.
If you renamed a model entry to Fable 5.2 this week, check it today. Any hand-written model row that your installed catalog does not know should carry an explicit maxTokens value, because the list view will not warn you. The same caution applies to benchmark results: an unexplained cut-off at a round number usually points to configuration, not a weak model.
Release Watch: 2026.11.5-beta.2 Is Tagged, 2026.11.3 Is Being Prepared
On Sunday we asked whether 2026.11.5-beta.2 would follow now that the stable line had moved. A signed v2026.11.5-beta.2 tag in the OpenClaw repository was created by release maintainer RomneyDa at 6:31 PM Pacific Monday. When we checked Tuesday morning there was still no GitHub release object for it, and npm still listed beta as 2026.11.5-beta.1, latest as 2026.11.2 and extended-stable as 2026.9.36. So the beta is tagged but not yet published. The 2026.11.5-beta.2 changelog at the tag leads with paged history for very large conversations, macOS saved secrets that survive failed config saves, and Android Talk no longer cancelling accepted work. It covers 95 pull requests.
The next stable patch is further along than it looks. The 2026.11.3 changelog on the release branch lists 34 pull requests and "No new configuration options or features." Its highlights include keeping private subagent completions out of streamed replies, reporting unanswered tool failures instead of silently ending a turn, and verifying workspace-transfer certificates before sending credentials. Two overnight merges point at a release soon. Pull request #196420 authorizes a scoped 2026.11.3 Kova performance waiver, which lets release validation accept one known failed performance job, though it "does not authorize release publication." Pull request #193884 recovers interrupted managed updates on 2026.11.3, backporting three update-recovery fixes, with the caveat that "an already-running old updater cannot acquire these fixes retroactively." For the extended-stable line, pull request #195135 completes required 2026.9.37 stability backports, and says the release is "not yet qualified or published."
Three release lines are moving at once: a beta, a stable patch and an extended-stable patch. Don't install from a tag. Wait for npm dist-tags to move, then read the matching changelog. For most teams 2026.11.3 is the one to plan for, because it is a fixes-only patch with credential-handling repairs and no new settings to review.
MCP Tools Get Cheaper to Find and Read
Two merges on Monday cut the token cost of MCP tools. Pull request #196252 lets models call listed MCP tools without searching first. It cites an analysis in which OpenClaw averaged about 3.8 tool_search calls per trial, each returning about 5.8 kB that was re-sent on every later request. The deferred MCP tool names now appear in the tool_search description, capped at 4,096 bytes and labelled as "untrusted data from the installed MCP servers, not instructions." Descriptions are cleaned and trimmed to one line of 96 characters or less. The PR says what this does not protect: a malicious server can still write misleading descriptions. Pull request #196243 stops sending wrapped MCP results to the model twice. Servers that return lists were sending both a wrapped copy and a bare copy, so agents calling them now send "roughly half as many tool-result tokens."
OpenClaw ID access also got tighter. Pull request #196276 keeps connected apps tied to the approving ID membership, so removing that member or key ends the app's access. Its rollout note says to "revoke and reapprove any older ID-origin grants that lack this binding." Pull request #194459 lets nodes reconnect after an OpenClaw ID server key rotation without rejoining.
Security Tip: Read a Skill's Setup Steps Before Your Agent Runs Them
Acronis's introduction to the Acronis TRU Cyber Pulse 2026 report, updated November 9, says its researchers "identified more than 575 malicious OpenClaw skills across 13 developer accounts, with packages impersonating legitimate utilities." Help Net Security's November 10 report on the Acronis findings carried that number in its headline. The finding itself is not new. It comes from Acronis TRU's April 30 investigation of AI supply chain attacks on Hugging Face and OpenClaw, which found a ClawHub campaign targeting Windows and macOS with trojans, cryptominers and the AMOS stealer. Two accounts uploaded 334 and 199 of the skills. The technique matters more than the count. The skills "instruct users to execute encoded commands or install hidden malicious dependencies," such as a password-protected "ClawHub-DependencyInstaller.zip" that had almost no antivirus detections at the time.
Before installing any ClawHub skill, open its audit. The ClawHub security audits guide says to check the audit status, risk level, findings and required credentials, and notes that a Pass "does not replace your own judgment." Then read the setup section yourself. Treat any request to paste an encoded command, download a password-protected archive or fetch an installer from a file-sharing site as a stop sign. The ClawHub moderation and account safety guide lists "suspicious install instructions" and impersonation as reasons to use the Report skill button.
Skill Card: coding-agent
Since this was a Claude-heavy night, this week's skill is the one that hands work to Claude Code and its peers. The bundled coding-agent SKILL.md in the OpenClaw repository describes it as a way to "delegate coding work to Codex, Claude Code, or OpenCode as background workers; not simple edits or read-only code lookup." It needs one of the claude, codex or opencode binaries and must be turned on with skills.entries.coding-agent.enabled. A few of its rules are worth knowing:
- Background only. Workers always launch with
background:true, and each one must report completion or failure withopenclaw message sendrather than relying on heartbeats. - Isolated worktrees. For Git projects the skill requires a fresh, verified worktree from the canonical remote before launch. It never uses the primary checkout, and never runs inside OpenClaw's own state directories.
- Untrusted code stays sandboxed. Contributor-controlled refs go through the repository's untrusted-PR review workflow, and a permission-bypassed worker is never launched in one.
- Separate Codex auth. Codex runs never inherit the ambient
CODEX_HOME; they use a separately authenticated home.
If you also run Claude Code through OpenClaw's claude-cli runtime, #196459 means aliases such as fable now follow Claude Code's own model menu. Separately, pull request #196206 keeps project session scratch out of shared clones by giving every new session on an OpenClaw-cloned project its own managed worktree.
The coding-agent skill launches Claude Code with --permission-mode bypassPermissions, so its safety depends on the worktree and trust rules around it. Keep those rules intact if you customize it. Name the exact model in the worker prompt rather than relying on an alias, and give the agent a notification route you actually watch before you hand it a long build.
What to Watch Next
First, whether npm publishes 2026.11.5-beta.2 and 2026.11.3, and whether 2026.9.37 qualifies for extended-stable. Second, whether #196587 merges and whether the unknown-Claude-model fix in #196459 reaches a tagged release, so stable users get Fable 5.2 without config workarounds. Third, any OpenClaw or ClawHub response to the renewed Acronis coverage. On X, an OpenClaw maintainer disputed a third-party harness benchmark whose OpenClaw responses were cut off at 8k tokens. We have not tied that dispute to issue #196544 and have left it out until the evaluator's rerun is public. We also left out an unverified "free credits" offer and a Bun startup-speed claim that no OpenClaw pull request confirms yet.
Rolling out new models or ClawHub skills?
SEN-X helps teams check model entries and output caps, plan 2026.11.3 upgrades, and review ClawHub skills and audits before agents install them.
Contact SEN-X →