OpenClaw 2026.11.3 Ships as a Security Release as Main Lets Owners Move a Claw to New Keys With Its Recovery Kit
OpenClaw 2026.11.3 is now the stable default, and its release notes call it a security release: worker-transfer certificate checks, sandboxed image previews and a long list of credential-exposure fixes. Extended-stable got 2026.9.37. On main, owners can now move an OpenClaw ID claw to new keys with its recovery kit, Fable 5.2 gets its full output limit, and OpenAI says ChatGPT Business plans now work in OpenClaw.
OpenClaw's fixes-only patch is now the default install. At 10:53 AM Pacific on Tuesday, OpenClaw published 2026.11.3, and the project's release notes open by calling it a security release: it fixes certificate checks on worker transfers, keeps sandboxed image previews inside allowed folders and cuts credential exposure. Two hours later, a 2026.9.37 patch for the slower extended-stable channel followed. Overnight on main, a different kind of security work landed. An owner can now move an OpenClaw ID claw to new keys with its recovery kit, and a stolen Gateway key can no longer lock clients out after that move. Meanwhile, OpenAI named OpenClaw among the tools where ChatGPT Business plans now work through Sign in with ChatGPT.
2026.11.3 Is Stable, and It Is a Security Release
The GitHub release for OpenClaw 2026.11.3 went up at 10:53 AM Pacific on Tuesday, November 10. When we checked at about 6:25 AM Wednesday, the npm dist-tags for the openclaw package showed latest at 2026.11.3, extended-stable at 2026.9.37 and beta still at 2026.11.5-beta.1. As we reported yesterday, a signed 2026.11.5-beta.2 tag exists, but it still has no GitHub release and has not reached npm.
The official 2026.11.3 release notes on docs.openclaw.ai put a label at the top: "Security release." The patch fixes "certificate verification for worker transfers with blank fingerprints," keeps "required-sandbox image previews within allowed folders" and "reduces credential exposure." It adds no features. The official @openclaw announcement of the 2026.11.3 patch, posted at 8:11 PM Tuesday, summed it up as interrupted-update recovery, fewer slow-storage backup timeouts and credential-handling fixes, from "56 PRs · 36 contributors." The two counts measure different things. The docs page counts 56 pull requests, 44 direct commits and 36 contributors, including backported work. The GitHub release's audited contribution record covers 34 pull requests in the v2026.11.2 range.
The credential fixes are the part most teams should read. Cached Firecrawl, Exa and Tavily results are no longer reused across different API keys. Firecrawl search and scrape no longer mix credentials with another connection's endpoint. Memory embedding credentials stay with their own provider. Another provider plugin can no longer redirect a provider connection to a different origin. Config reads stop exposing inline values in env.vars, and the active Exa key is redacted when an error echoes it. Managed Signal daemons and bundled language servers no longer inherit unrelated Gateway secrets. The notes warn that Signal setups which relied on inherited proxy or trust-store variables may now need to pass them another way. Twitch IRC parse errors stop copying message content into logs.
On updates, 2026.11.3 fixes interrupted managed updates that left the Gateway stopped, and backups and update discovery that failed on slow storage when a large SQLite check timed out. There is a catch the notes state twice. If an update from 2026.10.10 or 2026.11.1 is blocked by that timeout, "the installed updater cannot acquire this fix by selecting a newer version." Affected operators should follow the OpenClaw guide to updating safely and recovering a stuck update.
Treat 2026.11.3 as a priority update, not routine housekeeping. Most of its fixes stop a credential from reaching a place it should not: another endpoint, another key's cache, a child process or a log. Read the Signal and language-server notes before upgrading, because tighter environments can break setups that quietly relied on inherited variables. If an earlier update stalled, use the recovery guide rather than retrying blindly.
Extended-Stable Gets 2026.9.37
At 12:42 PM Pacific on Tuesday, OpenClaw published the GitHub release for the 2026.9.37 extended-stable patch. It calls itself "a gateway-only extended-stable release, published from a retired maintenance line by explicit maintainer decision." It is end-of-September OpenClaw plus security, reliability and performance fixes. Paired-node photos and screenshots are no longer attached to replies automatically. Linked model accounts survive /new, /reset and daily rollover. Interrupted snapshot writes keep the previous rollback point, and an unexpectedly closed MCP loopback listener is replaced instead of leaving later tool calls disconnected. It also carries the node certificate-pin fix that appears in 2026.11.3. The OpenClaw release channels guide describes extended-stable as package-only, foreground-only and "never applies automatically," so teams on that channel need to run the update themselves.
Output Caps: The Fallback Rises, Fable 5.2 Gets Its Full Limit on Main
Yesterday we covered issue #196544, about configured models silently capped at 8,192 output tokens. Part of the answer shipped in 2026.11.3. Its notes say it "reduces truncated replies and tool calls on affected models with unknown output limits by raising the fallback within the available context window." That change is pull request #193899, which replaces the 8,192-token output default with a context-aware default of up to 32,768. A model with an unknown window can now request up to 32,768 output tokens. A known 32K window gets 16,384. Saved numeric caps are not rewritten. Doctor points out old onboarding values such as 4,096 or 8,192 but does not change them. The PR also names the tradeoff: a strict provider can reject 32,768 with a 400 where 8,192 passed, and the fix then is to set that model's real maxTokens.
On main, pull request #196693 lets Claude subscription users reach new models without waiting for an OpenClaw release. It merged at 7:10 AM Tuesday. When Anthropic rejects a request because OpenClaw's built-in Claude Code version is too old, OpenClaw now adopts the version Anthropic names, resends once and remembers it. The same PR gives Fable 5.x and unknown Claude 5-contract models their catalog output cap, 128K for Fable 5.2, instead of a 32K compatibility clamp. In the issue thread, the reporter confirmed that setting maxTokens by hand on 2026.10.10 removed the 8,192 fallback, but replies were then cut at exactly 32,000 tokens. At 7:00 PM, pull request #196774 makes /fast work on Fable 5.2 and fall back safely on Claude models without fast mode. The issue itself was still open Wednesday morning, and pull request #196587, which names the output cap when max_tokens cuts an Anthropic tool call, has not merged.
The safest setting is still an explicit maxTokens for every hand-written model row. The new fallback helps people who never set one, but saved 4,096 or 8,192 values from old onboarding stay in force until you remove them. After upgrading, run Doctor, read its output-cap notes, and fix the rows it lists. Fable 5.2's full 128K limit is on main only for now.
OpenClaw ID: Move a Claw to New Keys With Its Recovery Kit
OpenClaw ID is the experimental Lab that lets a Gateway, called a claw, be reached remotely. Its key handling changed overnight. At 9:22 AM Tuesday, pull request #196380 stops a linked claw from minting new keys when its key files are lost. Before, a lost or replaced key file led the claw to create new keys and sign under keys its owner-signed binding did not name, which "strands every device." Now remote access stays off with a keys_missing or key_mismatch status, while the Gateway keeps running locally.
At 8:12 PM, pull request #196388 adds openclaw id rebind to move a claw to new keys with its recovery kit. The OpenClaw ID CLI reference says to use it "when a key file was lost or may have leaked," after moving to a new computer without the key files, or to rotate keys. The owner gives a link code from their OpenClaw ID account and types the recovery kit at a hidden prompt. The kit is "never accepted as an argument." Both keys move together. People, owner devices, nodes and invitations stay, and the Gateway accepts rebind only from a direct-loopback client on the same machine. Pull request #196402 makes clients follow a re-bind so a stolen Gateway key can't retire bindings, and pull request #196456 adds Move to new keys and key warnings to the Control UI.
This is the recovery path OpenClaw ID needed before anyone relies on it. Refusing to mint keys silently is the important design choice: a lost key now shows up as a clear status instead of quietly locking out devices. If you are testing the Lab, store the recovery kit offline today. The docs add that a key move does not review who has access, so check devices and people as well.
ChatGPT Business Plans Now Work in OpenClaw
At 9:50 AM Tuesday, OpenAI's developer account posted that ChatGPT Business plans now work in tools including OpenClaw through Sign in with ChatGPT. OpenAI's ChatGPT Learn guide to Sign in with ChatGPT lists OpenClaw under open-source integrations. It says signing in and using your plan are separate permissions, and that plan usage "counts toward your existing plan limits" without giving the app your conversations or memories. Business admins must first allow each app under Tenant settings, then External access, in admin.openai.com, and can cap the share of each member's allowance that outside services use.
On the OpenClaw side, the OpenClaw OpenAI authentication guide lists Sign in with ChatGPT as a beta method, connected with openclaw models auth login --provider openai --method siwc. You must approve token sharing during sign-in, or the account is saved but "cannot authorize inference." The guide is plain about the limits. OpenAI-hosted plugins, image generation, transcription and realtime voice are not supported by this credential, and "OpenClaw does not set per-app SIWC limits or show per-app usage." When a Business workspace limit is hit, the Control UI offers a "Copy request for admin" message to send to your admin.
For teams already paying for ChatGPT Business, this could replace a separate API bill for agent chat. Admins should set the per-service cap before members connect, because OpenClaw shows no per-app usage and agents can use up an allowance quickly. Keep a Platform API key for the features this credential does not cover, such as image generation, voice and memory embeddings.
Also on Main
Pull request #196772 disables core dumps for agent commands on Linux, so a crashing command no longer inherits the Gateway's unlimited core size. In its test, agent crash dumps fell from about 340 MB each to none. Pull request #197049 stops the iOS app from persisting pasted setup codes, which carry Gateway credentials and had stayed in plain text in the app's preferences and device backups. Pull request #197022 limits runtime path detail in Gateway health and status for read-only clients. Pull request #196756 sends compact JSON tool results to the model, which its author estimates saves roughly 20 to 25 percent of tokens on those results.
Security Tip: If You Rely on the Exec Allowlist, Update and Tighten It
One 2026.11.3 fix is easy to miss. It "requires normal authorization for dynamic shell test and [ predicates under the Gateway allowlist, closing an automatic-approval gap." Pull request #187884, which requires approval for dynamic shell predicates, explains the problem. A predicate could look harmless to OpenClaw's safe-builtin check while Bash later produced a different operand and ran an external command. Together with a quoting bug in the command renderer, this could let "a model supplied command cross the approval boundary without a matching allowlist entry or operator approval." Some quoted filenames with shell metacharacters now need approval and may be denied when approvals are off.
First, update to 2026.11.3. Then check which mode you actually run. The OpenClaw exec tool reference says no-approval host exec (mode=full) is the default for gateway and node. allowlist mode runs only allowlisted commands, and ask sends everything else to a human. For strict explicit trust, the docs say to keep autoAllowSkills disabled. Consider tools.exec.strictInlineEval, which requires review for forms such as python -c and node -e. The openclaw approvals and exec-policy CLI reference covers how to inspect the effective policy, including openclaw exec-policy show --agent main.
Skill Card: sherpa-onnx-tts
This week's skill keeps speech on your own machine. The bundled sherpa-onnx-tts SKILL.md in the OpenClaw repository describes "Local text-to-speech via sherpa-onnx (offline, no cloud)." It runs on macOS, Linux and Windows and needs two environment variables, SHERPA_ONNX_RUNTIME_DIR and SHERPA_ONNX_MODEL_DIR.
- Install. The skill downloads the sherpa-onnx runtime for your OS into the OpenClaw state directory, with pinned SHA-256 checksums for the runtime archives, plus the Piper en_US "lessac" voice model.
- Configure. Write the resolved runtime and model paths under
skills.entries["sherpa-onnx-tts"].envin your OpenClaw config. - Use. Run the wrapper, for example
sherpa-onnx-tts -o ./tts.wav "Hello from local TTS.". Pass--model-fileif the model folder has more than one.onnxfile.
It got a fix overnight. At 11:20 PM Tuesday, pull request #197103 stops sherpa-onnx-tts from overwriting tts.wav when an option has no value. Before, an empty or trailing --output silently fell back to tts.wav and overwrote an existing recording. --output --model-dir x even wrote a file named --model-dir. Now any empty, missing or option-shaped value prints usage and exits before the speech engine runs.
What We Checked and Left Out
A post on X asked which 11.x fixes carry security IDs and cited CVE-2026-25253 as a "one-click RCE." The NVD record for CVE-2026-25253 describes a gatewayUrl query-string token leak in OpenClaw versions before 2026.1.29, from February, so it does not apply to the 11.x line. The newest entries on the OpenClaw GitHub security advisories page were published in September, and we found no advisory tied to 2026.11.3. We also left out a third-party scanner's score for a skill named "openclaw," vendor hosting promotions, an unverified model-naming tip and further back-and-forth on X about the 8k-cut benchmark, which we could not tie to new published results.
What to Watch Next
First, whether 2026.11.5-beta.2 reaches npm, and whether it carries the Fable 5.2 output-cap and fast-mode work from main. Second, whether #196587 merges and issue #196544 closes. Third, whether OpenClaw ID's rebind reaches a tagged release, and whether OpenClaw adds per-app usage visibility for Sign in with ChatGPT now that Business workspaces can connect.
Planning the 2026.11.3 upgrade?
SEN-X helps teams roll out security patches, tighten exec approvals, and set up model sign-in and usage limits before agents go to work.
Contact SEN-X →