OpenAI Details How It Secures Hundreds of OpenClaw Agents as ClawCon Heads to Shenzhen and Failed Updates Roll Back
OpenAI publishes the sandbox, auto-review, identity and logging controls it uses to run hundreds of OpenClaw agents internally. Claw Hack and ClawCon come to Shenzhen on December 4-6. On main, failed updates now roll back, 2026.11.4 moves through release qualification, native chat keeps drafts, and Telegram widgets reach private-chat topics.
The biggest OpenClaw story of the past day did not come from the OpenClaw repository. On Thursday, OpenAI's developer blog published a detailed account of how the company secures the hundreds of OpenClaw agents it runs internally, down to the sandbox settings it uses, and the official @openclaw account pointed readers to it as the place to learn how OpenClaw Enterprise protects persistent agents. Early Friday, the project announced that Claw Hack and ClawCon are coming to Shenzhen in December. On main, updates learned to roll themselves back when a new release fails Doctor or cannot start the Gateway, native chat stopped losing drafts, and Telegram widgets now work in private-chat topics. No new release shipped overnight.
OpenAI Shows How It Locks Down Hundreds of OpenClaw Agents
OpenAI's developer blog post "Securing persistent agents like OpenClaw at OpenAI", dated November 12 and written by Kevin S Lin, says the company has persistent agents deployed across the company, "including hundreds of OpenClaw agents." At 12:36 PM Pacific the same day, the official @openclaw post pointing to the OpenAI write-up described it as a breakdown of "the controls used at OpenAI to deploy OpenClaw agents internally."
The post starts from a threat model that differs from ordinary software. Persistent agents run around the clock, can change their own configuration and can write arbitrary code, so in OpenAI's words, "Attacks come from the inside when agents take misaligned actions." Its answer is to separate trusted, deterministic logic (networking, identity and sandboxing) from untrusted model execution. To do that, OpenAI says it implemented remote harness execution in the open-source project, which lets the OpenClaw Gateway run in a separate container, and in OpenAI's case a separate cluster, from the agent harness. The Gateway is treated as trusted code, and the agent workload is sandboxed as untrusted code.
The sandbox controls are listed in four groups. Network access goes through an organization-managed allowlist with explicit denials. Writes are allowed only in agent working directories. Processes are isolated with the Codex Linux sandbox. Secrets are handled by a credential broker, so the agent never sees them. The post publishes sample requirements.toml and config.toml settings: the unrestricted danger-full-access mode is removed, only cached hosted web search is allowed, a managed network proxy is required, and the deny list includes paste and webhook sites plus cloud metadata endpoints such as 169.254.169.254. The sample also denies access to the SSH credentials folder and strips GitHub tokens from agent command environments, while noting that this "does not hide credentials stored in accessible files."
Three further layers sit on top. OpenAI enforces auto-review on all agent actions, so a second model approves the primary agent's actions and human attention is saved for high-value approvals; the post says this is natively supported in both OpenClaw and Codex. Each agent has its own identity tied to a ChatGPT Service Account, which gives it an inference credential separate from the user's and lets OpenAI audit its actions or turn off its inference. And OpenAI logs every control-plane configuration change and every agent turn, with those logs restricted to a few people on the security team. The post says OpenAI now has more than 500 agents running proactively in the background, and that OpenClaw Enterprise, the open-source control plane announced at OpenAI DevDay, is still in pilot with a 1.0 release planned by the end of the year.
This is the most concrete public blueprint we have seen for running OpenClaw at company scale, and its core idea transfers to small teams: treat the Gateway as trusted and the agent as untrusted. Most self-hosted setups still give the agent the same network, files and keys as the machine it runs on. Start by closing that gap.
ClawCon and Claw Hack Head to Shenzhen, December 4–6
At 5:12 AM Pacific on Friday, OpenClaw's Vincent Koc posted that ClawCon is coming to Shenzhen in December, linking to the OpenClaw blog announcement "OpenClaw is coming to Shenzhen". The post describes a three-day event from December 4 to 6, 2026. Claw Hack, the OpenClaw hackathon, runs Friday and Saturday, with members of the core team in the room to pair-program, review PRs and troubleshoot. ClawCon, which the post calls the project's flagship conference, follows on Sunday afternoon on two tracks.
The hackathon has a software track covering Skills, Plugins, integrations, local knowledge tools and new interfaces, and a hardware track with M5Stack development hardware, Seeed Studio's open-source reBot Arm B601, Pamir's Lapis One and the Autonomous Lamp. The post says some of the hardware is unreleased. ClawCon will include talks and demos on open-weight models, building and evaluating agents, and what it costs to run agents locally and in the cloud, plus a Claw Clinic for hands-on setup help. Partners listed include Tencent, NVIDIA, vLLM, M5Stack, Seeed Studio and NYU Shanghai. The two events have separate Luma registrations, and Claw Hack applications close on November 25.
The hardware track is the part to watch. Robot arms, lamps and sensor kits give agents physical side effects, which raises the same trust questions OpenAI's post raises for code and networks. Teams building device skills should bring a clear permission story along with the demo, because a sandbox for a robot arm looks very different.
Failed Updates Now Roll Back, and 2026.11.4 Moves Through Qualification
At 11:38 PM Pacific on Thursday, main merged pull request #197851, which rolls back activated releases that fail Doctor or Gateway startup. The PR describes two gaps that meant "a bad release could stay installed after activation." Rollback after activation had no record of the earlier state schema unless the pre-activation canary supplied one, so it reported rollback-state-unverified and left the bad release in place. Updates that did not restart a service also never booted the new release at all.
Now the baseline is read for every SQLite-backed update, and a new activated-gateway-startup step boots the new release once on real state, with channels, providers, cron and watchers suppressed, and waits up to two minutes for /readyz. If the Gateway cannot become ready, the update falls into the existing rollback. The PR's test table shows the difference: with the canary skipped, a Gateway that crashes at boot, a Doctor change that writes an invalid config value, and a state migration that throws each left main on the bad commit, while the new build rolled back to the earlier version with a healthy Gateway. PostgreSQL state keeps the older behavior for now, and the step is skipped when a running Gateway owns the state, when the profile uses a remote Gateway, or when the Gateway serves TLS.
Release tooling also points at a version we have not seen yet. Pull request #198107, which unblocks exact 2026.11.4 qualification, says "Release 2026.11.4 can proceed through its required validation," and records a maintainer-approved exception for 21 retained RSS memory threshold violations and one Gateway CPU overage of 410.6% against a 360% limit. A follow-up, pull request #198271, which applies the 2026.11.4 performance waiver release-wide, merged at 5:23 AM Friday and widens the waiver to every 2026.11.4 performance run while keeping correctness, crash, data-integrity and install or update gates mandatory. Neither PR changes shipped behavior. When we checked at about 6:30 AM Friday, GitHub had no 2026.11.4 tag or release, and npm still listed 2026.11.3 as latest and 2026.11.5-beta.2 as beta.
Automatic rollback after a failed boot is the update safety net many self-hosters assumed they already had. Until it ships in a release, keep doing what the PR's own test table implies: back up state before updating, update with a restart so readiness is checked, and confirm the Gateway answers before you walk away.
Native Chat Keeps Drafts and Gives Rejected Messages Back
Two related changes fix a common annoyance in the iOS and macOS chat apps. Pull request #197846, which keeps composer drafts across app restarts, merged at 12:03 PM Thursday. Drafts used to live only in memory, so a crash, a forced quit or iOS closing the app in the background lost whatever you were typing, along with any picked attachments. Drafts are now saved per session in the client's local state store, and the existing Forget action deletes them along with a Gateway's other data.
Building on it, pull request #197908, which lets you edit queued messages and returns rejected sends to the composer, merged at 1:25 PM. You can now touch and hold a queued or failed message and choose Edit, which moves its text and attachments back into the composer. When the Gateway definitely rejected a send and chat history proves it never arrived, the message returns by itself with a "Not sent" note. A message that may already have been delivered is never moved, so the change cannot duplicate text.
Telegram Widgets Reach Private-Chat Topics
At 10:55 PM Thursday, main merged pull request #198022, which routes Telegram widgets in private topics. Widgets had been turned off in private-chat topics because Telegram's widget query carries the chat and message but not the topic, so a tap could not find its way back. Each sent widget now records its topic, and a tap is placed in that topic's queue before it is handled. With channels.telegram.widgets: true, people who run their bot chat in Threaded Mode now get widgets there, and taps update them in place. Groups and channels are unchanged. The OpenClaw guide to Telegram rich messages and widgets already reflects the change and notes that widgets stay off by default because older Telegram clients cannot render them.
Also on Main
- Pull request #198214 makes only the running Gateway refresh shared OAuth sign-ins (6:00 AM Friday). Commands such as
infercould refresh a shared sign-in beside a running Gateway, after which every later turn on that profile failed until a restart. They now refuse with a message saying no credential was changed. - Pull request #198161 keeps Anthropic setup tokens off the OAuth usage endpoint (6:08 AM Friday), which setup tokens may not be scoped for, so usage status stops showing an HTTP error instead of quota.
- Pull request #198250 downscales tall screenshots instead of dropping them (4:27 AM Friday). Images over 25 megapixels, up to 64, now reach the model, where before the drop could abort a whole
claude-cliturn. - Pull request #198163 stops
skills update --allafter Ctrl+C (3:03 AM Friday). The skill being updated finishes, no other update starts, and skills not yet reached stay at their installed version.
Security Tip: Give Sandboxed Agents No Network Until They Need It
OpenAI's post leads with network control: an allowlist of required hosts, with explicit denials for paste sites, webhook catchers and cloud metadata addresses. You can start in the same place on a self-hosted Gateway. The OpenClaw sandbox configuration reference says sandbox containers default to network: "none", that "host" is blocked, and that you have to opt in to "bridge" for outbound access. It also notes that Codex app-server turns in an active OpenClaw sandbox follow the same egress setting.
- Check what is really in effect. The openclaw sandbox CLI reference describes
openclaw sandbox explain, which shows the effective sandbox mode, workspace access, sandbox tool policy and elevated-tool gates, with the config keys that fix them. Run it per agent with--agent. - Keep setup egress separate. The reference notes that
setupCommandruns once after container creation and needs network egress. If installing packages was the only reason you opened the network, bake them into the sandbox image instead and leave the network at"none". - Recreate after changes. The same page warns that changing sandbox config does not affect running containers, which keep their old settings until pruned. Run
openclaw sandbox recreate --allafter changingagents.defaults.sandbox.*.
Skill Card: Telegram Widgets Skill
With widgets now working in private topics, the Telegram Widgets Skill on ClawHub, published by HappySean, is a timely community pick. It helps an agent reply on Telegram with a small HTML widget card, such as a price, poll, checklist, chart or countdown, then check it, send it and update it later. Its SKILL.md lists compatibility with OpenClaw and Hermes Agent, requires python3 and a TG_WIDGETS_BOT_TOKEN, and says the token is sent only to the Telegram Bot API. On OpenClaw with the built-in show_widget tool, it tells the agent to run the skill's checker first and then send with show_widget.
- Strict by design. Its checker blocks links unless the operator allowlists a host, and bans
innerHTML,eval, network calls and external images. Version 1.0.2, published at 8:36 PM Pacific on November 11, closes "a link-check bypass found by the ClawHub scan." - Read the scan. The ClawHub security scan for Telegram Widgets Skill 1.0.2 shows a split result. The overall status is clean with warnings, and ClawScan judged it benign with medium confidence, but the Skillspector scanner rated it suspicious and critical, with six findings and a "do not install" recommendation. ClawScan treated those findings as expected for the skill's purpose and noted that its own scan was partial.
- Very new. The listing showed 98 downloads and 2 installs when we checked. Review the network, file-write and environment findings before giving it your bot token.
What We Checked and Left Out
A user post on X said openclaw config patch replaces arrays instead of merging them, which could silently shrink a Telegram allowlist. We found no matching GitHub issue or documentation, so we left it out for now. We also skipped an unsourced claim about fake trading skills stealing wallet keys, a tease of a new agent launch with no details, and a model catalog addition we do not cover. Issue #196544, the 8,192-token default output cap we reported on November 10, is still open, and its fix PR has not merged.
What to Watch Next
First, whether 2026.11.4 ships as a stable release and which main changes it carries, including the update rollback. Second, whether OpenClaw publishes its own guide to the controls OpenAI described, especially remote harness execution and auto-review. Third, the Shenzhen speaker list and program, and whether the hardware track brings new device skills to ClawHub.
Running persistent agents with real access?
SEN-X helps teams split trusted Gateways from untrusted agent workloads, lock down sandbox egress, and test updates and rollbacks on staging before they reach production agents.
Contact SEN-X →