OpenClaw 2026.11.5 Beta 2 Reaches npm as Claude Fable 5.2 Goes Official and Snyk Re-Scans 10,000 ClawHub Skills

The next OpenClaw feature release is now something you can actually install. At 3:33 PM Pacific on Wednesday, 2026.11.5-beta.2 reached npm on the beta channel, and its GitHub release followed at 4:43 PM, about two days after its signed tag was created. It is a reliability-heavy beta: long conversations stay browsable, retried messages stop starting duplicate turns and failed upgrades recover cleanly. Earlier that morning, the official @openclaw account announced that Claude Fable 5.2 is available in OpenClaw, and main fixed the $0.00 cost readout that hid what Fable 5.2 turns were really spending. On ClawHub, Snyk published a second look at skill security, and a Shopify plugin from Shopify's own account shows how much a publisher badge does and does not tell you.

2026.11.5-beta.2 Lands on npm With 95 Pull Requests

The GitHub pre-release for OpenClaw 2026.11.5-beta.2 was published at 4:43 PM Pacific on Wednesday, November 11. When we checked at about 6:20 AM Thursday, the npm dist-tags for the openclaw package listed beta at 2026.11.5-beta.2, while latest stayed on 2026.11.3 and extended-stable on 2026.9.37. Nothing changes for people on the default channel. The release's audited contribution record covers the range from beta.1 and counts 95 unique pull requests.

Three highlights lead the notes. Large conversations stay browsable, with paged history in both directions, visible history boundaries and bounded archive reads. The macOS app keeps saved secrets and Gateway authentication when a configuration save fails or Tailscale exposure is turned off. And ending Talk on Android no longer cancels work the Gateway has already accepted.

The fixes list reads like a catalog of the ways an agent can lose track of its own work. Message delivery now acknowledges retried input that was already committed instead of starting a duplicate turn, and keeps queued messages during inline edits. Chat recovery preserves completed reasoning and resumes configured fallbacks after interrupted attempts. Tool outcomes keep their timeout results, so an interrupted tool is not mistaken for a confirmed failure with no side effects. Updates "recover cleanly from failed upgrades out of 2026.10.7–2026.10.9." Two items are labeled security: malformed URI identifiers are rejected through fast-uri 4.2.3, and oversized bounded collections are rejected early in the Discord SDK and its Zod 3 parser.

One configuration fix deserves a closer look from anyone who restricts plugins. OpenClaw now ignores empty default plugin entries "rather than widening an explicitly restricted plugin allowlist." Anthropic users also get a fix that keeps setup-token credentials separate from API-key profiles. The beta.2 notes do not mention the output-cap or OpenClaw ID work we covered this week, so those changes remain on main for now.

Claude Fable 5.2 Is Official in OpenClaw, and Main Fixes Its $0 Cost Readout

At 8:12 AM Pacific on Wednesday, the official @openclaw announcement that Claude Fable 5.2 is available in OpenClaw said: "Anthropic reports up to 30% faster output generation than Fable 5.1." Anthropic's Claude Fable 5.2 and Mythos 5.2 launch page, dated November 9, says the models generate output up to 30% faster than the 5.1 versions and cost $8 per million input tokens and $40 per million output tokens. An optional fast mode speeds generation by up to 2.5 times at $16 and $80. Anthropic still recommends starting most coding and knowledge work on Claude Opus 5.5 and moving up to Fable for the most ambitious technical tasks.

Earlier the same morning, at 7:23 AM, main merged a fix that matters for anyone watching spend. Pull request #197246, which fixes chat and session costs showing $0 for new Claude models, explains that chat, the Control UI context chip, session rows and openclaw agent --json showed $0.00, or no cost at all, for models whose price OpenClaw does not bundle yet, "such as Claude Fable 5.2 on an API key," and for every Claude CLI subscription turn. Usage reports already priced those tokens correctly, so two views of the same session disagreed. Now each model call records what the API would charge at the rate of the model that served it, including after a fallback or a mid-session model switch. Operators who set explicit free pricing keep their $0.

A second change shifts a default for Claude CLI users. Pull request #197291, which gives managed claude-cli turns Claude Code's native web search by default, merged at 11:34 AM. Searches are billed to the Claude login, and every existing gate still applies: the agent's tool policy must allow web_search, and a configured OpenClaw search provider keeps priority. The PR says an existing claude-cli session resets once when upgrading from 2026.11.3, then resumes normally. To turn it off, set plugins.entries.anthropic.config.managedNativeTools.default to an empty list.

On the output cap we reported Tuesday, issue #196544 about the silent 8,192-token output cap was still open when we checked Thursday morning. A review-bot comment on the issue says main now handles the old fallback and the Claude-family clamp, but a separate open pull request still owns the error message that should name the output limit when a cut-off tool call is rejected.

Advisor Leaves Labs, Still Off by Default

At 7:15 PM Wednesday, pull request #197029, which moves Advisor out of OpenClaw Labs, merged on main. Advisor no longer sits under Settings → Labs. Users turn it on with the Enable button on Settings → Plugins → Advisor, and the change applies without a restart. It stays off by default, existing config keeps working unchanged, and injected advice now starts with "Advisor:" instead of "Advisor (OpenClaw Labs):".

The new Advisor plugin reference on docs.openclaw.ai spells out the cost. Advisor forks the conversation on the session's own model and asks whether the agent is on track, stepping in when it repeats failing steps, drifts beyond the request or claims results the tools do not show. Each review is an extra model call, at most one per everyMinutes of work by default, and a review that misses the provider cache "processes the whole conversation again, which on a long session can be hundreds of thousands of tokens."

Snyk Re-Scans the Top 10,000 ClawHub Skills

Snyk's research team published Snyk's re-assessment of agent skill security across skills.sh and ClawHub, dated November 9, and it circulated on X this week. Snyk analyzed the 10,000 most popular skills on each marketplace, downloaded on October 27. In Snyk's framework a critical finding always means a skill is actively malicious. It found 7 critical skills on skills.sh and 11 on ClawHub, plus 930 ClawHub skills whose most severe finding was high. Across both registries, Snyk says more than 64% of the analyzed skills are vulnerable, promoting behavior that exposes agents to sensitive systems, wallets, untrusted content or hardcoded credentials.

The malicious examples are subtle. One ClawHub skill, auto-updater-skill, presents itself as the "Official" OpenClaw updater from an "OpenClaw Official Team," lists a fake contact address and asks for administrator rights to install a daemon that starts at boot. Other skills Snyk rated critical impersonate trusted APIs to collect keys or ship obfuscated code that handles a user's GitHub token. Snyk's conclusion is direct: overtly malicious skills "have become rare but also more sophisticated," while unsafe behavior remains widespread. It advises installing only from publishers you can verify and keeping wallet keys and other credentials out of the agent's reach.

The same theme ran through a TechRadar opinion piece on Wednesday. In TechRadar's column on OpenClaw's privileged access problem for security teams, Joseph Perry of Arcova argues that the core issue is aggregation: one assistant can reach email, documents, payments and local systems that organizations have historically secured separately, which turns it into "a privileged control point." He recommends that security teams start with visibility into where OpenClaw is installed and what it can reach, then apply least privilege.

Also on Main

• Mac nodes through OpenClaw ID invitations. At 6:14 AM Thursday, pull request #196759, which enrolls Mac nodes through OpenClaw ID invitations, merged. Native-enabled Mac builds can redeem a private node invitation, show a verification code for owner approval and connect as a node. A node grant does not include browser, operator or chat access, and the Mac app's first-run setup now asks where the assistant should run.
• Spawn a session on a chosen device. At 12:42 AM, pull request #197469, which lets sessions_spawn target a paired device, added placement: { kind: "device", deviceId } for visible worktree sessions. An unavailable device returns an error and keeps the child for inspection instead of running the task elsewhere.

What We Checked and Left Out

A vendor post on X claimed a specific count of OpenClaw security advisories in a comparison with another agent framework. We could not confirm the figure, so we left it out. We also skipped an X summary of a continual-learning benchmark that tested OpenClaw because we found no primary paper or repository, community command tips we did not verify against the docs this run, third-party firewall and audit-trail promotions, and a run of contest-style comparison posts.

What to Watch Next

First, whether beta.2 testers turn up regressions in the retry and recovery changes before 2026.11.5 goes stable. Second, whether the Fable 5.2 output-cap fixes, the cost readout fix and the SecretRef and compaction fixes reach the next beta. Third, how ClawHub responds to Snyk's 11 critical findings and to official-looking listings that impersonate the project.