OpenClaw 2026.6.6 Pre-Release: Massive Security Hardening Across 13 Areas

OpenClaw 2026.6.6 landed June 10 as a pre-release, and this one is all about security. Thirteen separate PRs touched security boundaries across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions. Exec approvals now fail closed on timeout — meaning if approval can’t be obtained within the timeout window, the execution is denied rather than allowed.

Security: The Headline

The broad security sweep covers a lot of ground:

  • Transcripts and sandbox binds — tighter boundaries on what agent transcripts can expose and how sandboxed environments inherit host state
  • Host environment inheritance — process environment variables no longer leak into contexts they shouldn’t
  • MCP stdio — Model Context Protocol standard I/O channels hardened against injection
  • Codex HTTP access — tighter validation on what the Codex harness can reach over HTTP
  • Native search policy — search results now subject to stronger conformance checks
  • Elevated sender checks — verification that a sender is actually authorized before granting elevated access
  • Deleted-agent ACP bypasses — agents that have been deleted can no longer sneak through ACP access controls
  • Loopback tools — tools targeting loopback interfaces restricted to prevent local service abuse
  • Discord moderation — hardened against malicious moderator actions
  • Teams group actions — broader Teams integration security improvements
  • Exec approvals fail closed on timeout — the big policy change: if an exec approval times out, the execution is denied

Telegram: Resilience and Coherence

Telegram delivery saw significant work beyond the security sweep:

  • Account-scoped topics now route to the right agent
  • Streamed text survives tool calls without losing coherence
  • /compact works on generic ingress
  • Callback handling uses concrete APIs
  • Draft chunking is shared across sessions
  • Durable dispatch dedupe moved into the SDK
  • Unauthorized DM text stays out of cache and prompt context

iMessage: Recovery and Delivery

iMessage received a similar treatment with focus on always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics.

Browser and MCP Connectivity

Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile cdpUrl handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility.

Release metadata

  • Version: 2026.6.6 (pre-release)
  • Released: June 10, 2026
  • Notable: 13+ security PRs, exec approvals now fail closed on timeout

See the full release notes on GitHub.

← Back to News