Guide

OpenClaw v2026.5.27: Stronger security and content boundaries, upgrade notes

May 28, 20266 min readUpdated September 11, 2026By OpenClawBlog Team

v2026.5.27 arrived on 2026-05-28 with a change that matters during maintenance: stronger security and content boundaries. The page is a researched reading note from the official release record, with a test path for a real Gateway.

The tag is stable, but the direct notes still define its migrations, corrections, and package-specific limits. Support still depends on the provider, channel, platform, and account behind the installation, so check those boundaries before extrapolating from the tag.

Channel
Stable

Primary signals
Stronger security and content boundaries; More reliable Codex app-server runs; Faster Gateway and reply paths

Publication date
2026-05-28

Before the package changes

Stronger security and content boundaries

Evidence from the release. group prompt text is kept out of the system prompt, repeated-dot hostnames are normalized, side-effecting command wrappers and unsafe Node runtime env overrides are blocked, no-auth Tailscale exposure is rejected, and node/device-role approvals now require admin authority.

Operator reading. Read Stronger security and content boundaries as an authorization checkpoint: prove who may act, what the action can reach, and how the rejected attempt is surfaced to the operator.

More reliable Codex app-server runs

Evidence from the release. Codex runtime models resolve first, workspace memory is routed through tools, shared app-server clients survive startup and spawned-helper failures, native hook relay generations survive restarts and rotate on fresh fallbacks, and false runtime live switches are avoided.

Operator reading. Check More reliable Codex app-server runs with a known prompt and a disposable account. Save the selected route, reasoning setting, latency, and refusal or fallback result so another operator can reproduce it.

Faster Gateway and reply paths

Evidence from the release. session reads, plugin metadata fingerprints, auth env snapshots, auto-enabled plugin config, tool-search catalogs, and stable metadata caches do less hot-path rediscovery while visible replies no longer inherit hidden cleanup timeouts.

Operator reading. The useful evidence for Faster Gateway and reply paths is the refusal path as well as the success path. Use synthetic credentials and record the policy that made each decision.

Better provider and model coverage

Evidence from the release. OpenAI-compatible embedding providers are core, DeepInfra catalog browsing loads the full credential-aware model set, Pixverse adds video generation and API region selection, VLLM thinking params are wired, Claude CLI OAuth overlays load for PI auth profiles, and bare direct Anthropic model ids work.

Operator reading. Read Better provider and model coverage as an authorization checkpoint: prove who may act, what the action can reach, and how the rejected attempt is surfaced to the operator.

Details behind the headline

Channel delivery is steadier

Telegram sendMessage actions use durable outbound delivery, iMessage suppresses duplicate native exec approval prompts and sends, Slack keeps delivered final replies during late cleanup, Matrix mention previews/finals are stricter, QQBot fallback approval buttons honor slash-command auth, Discord guild requester checks are tighter, recovered Discord tool-warning artifacts stay out of successful replies, and Google Chat stops thread sends in DMs.

Read Channel delivery is steadier as an authorization checkpoint: prove who may act, what the action can reach, and how the rejected attempt is surfaced to the operator.

Memory

add a core OpenAI-compatible embedding provider for local and hosted OpenAI-style endpoints, with config, doctor, and docs support.

Check Memory with a known prompt and a disposable account. Save the selected route, reasoning setting, latency, and refusal or fallback result so another operator can reproduce it.

Plugin SDK

mark memory-specific embedding provider registration as deprecated compatibility and surface non-bundled usage in plugin compatibility diagnostics.

The safe reading of Plugin SDK is operational: prove the model can answer the intended task, then force a bounded failure and verify that no side effect is repeated.

Test this release without widening the boundary

Note the current version, host, provider, and workspace before exercising Stronger security and content boundaries.
Keep a tested backup beside the release record if the update can touch configuration, sessions, or a database.
Send one harmless message through the named account and save the account, thread, and sender identifiers.
Compare the transcript before and after reconnect, including delivery state and any visible error.
Stop if the observed behavior falls outside the official note, and link the log or screenshot to the version record.

openclaw --version
openclaw gateway status
openclaw security audit

Record what the release actually changed

Keep the version, source URL, test identity, and rollback decision together. If this tag is pre-release, leave it isolated; if it is stable, record the migration and rollback result before reconnecting every channel.

Corrections worth replaying

Security/content boundaries. route untrusted group prompt metadata outside system prompts, normalize repeated trailing hostname dots, block side-effecting command wrappers, reject unsafe Node runtime env overrides, reject no-auth Tailscale exposure, block untrusted Microsoft Teams service URLs, enforce /allowlist configWrites origin policy, gate QQBot fallback approval buttons, and require admin for node/device-role approvals. Keep the reproduction and the post-fix result together in the acceptance record.

Codex. resolve Codex runtime models before generic routing, route workspace memory through tools, preserve shared app-server clients after startup and spawned-helper failures, preserve native hook relay generations across restarts and fresh fallbacks, keep raw reasoning/source-reply guards intact, report quarantined dynamic tools, keep the attempt watchdog armed for queued terminal turns, and route Codex OAuth compaction through OpenAI-Codex. Record the failure that this correction addresses before declaring the upgrade complete.

Use the complete OpenClaw v2026.5.27 release notes for the exact change list, then cross-check the official release index and the model provider reference before acting.