OpenClaw v2026.5.27-beta.1: Stronger security and content boundaries, provider notes

v2026.5.27-beta.1 changes how an agent selects, calls, or remembers a provider. The official record describes a provider, model, voice, or context change; the useful test is a small request with the provider boundary recorded.

Because this is a pre-release, use a disposable Gateway first and leave the stable version available for comparison. The release body cannot certify every local combination of provider, channel, platform, and account; use the bounded test below for the path you actually run.

Provider and model consequences

01 / Stronger security and content boundaries

Source signal. group prompt text is kept out of the system prompt, repeated-dot hostnames are normalized, side-effecting command wrappers and unsafe Node runtime env overrides are blocked, no-auth Tailscale exposure is rejected, and node/device-role approvals now require admin authority.

Read Stronger security and content boundaries as an authorization checkpoint: prove who may act, what the action can reach, and how the rejected attempt is surfaced to the operator.

02 / More reliable Codex app-server runs

Source signal. Codex runtime models resolve first, workspace memory is routed through tools, shared app-server clients survive startup and spawned-helper failures, native hook relay generations survive restarts and rotate on fresh fallbacks, and false runtime live switches are avoided.

A catalog label for More reliable Codex app-server runs is only the first signal. Confirm the account, endpoint, context limit, and tool policy that the running Gateway actually selected.

03 / Faster Gateway and reply paths

Source signal. session reads, plugin metadata fingerprints, auth env snapshots, auto-enabled plugin config, tool-search catalogs, and stable metadata caches do less hot-path rediscovery while visible replies no longer inherit hidden cleanup timeouts.

The useful evidence for Faster Gateway and reply paths is the refusal path as well as the success path. Use synthetic credentials and record the policy that made each decision.

04 / Better provider and model coverage

Source signal. OpenAI-compatible embedding providers are core, DeepInfra catalog browsing loads the full credential-aware model set, Pixverse adds video generation and API region selection, VLLM thinking params are wired, Claude CLI OAuth overlays load for PI auth profiles, and bare direct Anthropic model ids work.

The useful evidence for Better provider and model coverage is the refusal path as well as the success path. Use synthetic credentials and record the policy that made each decision.

What changes outside the chat box

Channel delivery is steadier

Telegram sendMessage actions use durable outbound delivery, iMessage suppresses duplicate native exec approval prompts and sends, Slack keeps delivered final replies during late cleanup, Matrix mention previews/finals are stricter, QQBot fallback approval buttons honor slash-command auth, Discord guild requester checks are tighter, recovered Discord tool-warning artifacts stay out of successful replies, and Google Chat stops thread sends in DMs.

Read Channel delivery is steadier as an authorization checkpoint: prove who may act, what the action can reach, and how the rejected attempt is surfaced to the operator.

Memory

add a core OpenAI-compatible embedding provider for local and hosted OpenAI-style endpoints, with config, doctor, and docs support.

Check Memory with a known prompt and a disposable account. Save the selected route, reasoning setting, latency, and refusal or fallback result so another operator can reproduce it.

Plugin SDK

mark memory-specific embedding provider registration as deprecated compatibility and surface non-bundled usage in plugin compatibility diagnostics.

The safe reading of Plugin SDK is operational: prove the model can answer the intended task, then force a bounded failure and verify that no side effect is repeated.

A bounded check for this version

1. Start with a disposable checkpoint: record the version, host, provider, and workspace tied to Stronger security and content boundaries.
2. Check the release's migration notes and make a restorable backup before changing persistent state.
3. Use a disposable conversation for one send, one reconnect, and one retry; keep the destination identifiers with the result.
4. Leave the channel disabled after the test if its credentials or pairing were created only for this rehearsal.
5. If the result differs from the release body, stop the rollout and attach the log, screenshot, or transcript to the version record.

openclaw --version
openclaw gateway status
openclaw security audit

Close the loop with evidence

A useful maintenance record names the changed behavior, the behavior that stayed stable, the identity that approved the test, and the step that would undo it. Preserve that record beside the release tag.

Edge cases in this tag

Security/content boundaries. route untrusted group prompt metadata outside system prompts, normalize repeated trailing hostname dots, block side-effecting command wrappers, reject unsafe Node runtime env overrides, reject no-auth Tailscale exposure, block untrusted Microsoft Teams service URLs, enforce /allowlist configWrites origin policy, gate QQBot fallback approval buttons, and require admin for node/device-role approvals. Record the failure that this correction addresses before declaring the upgrade complete.

Codex. resolve Codex runtime models before generic routing, route workspace memory through tools, preserve shared app-server clients after startup and spawned-helper failures, preserve native hook relay generations across restarts and fresh fallbacks, keep raw reasoning/source-reply guards intact, report quarantined dynamic tools, keep the attempt watchdog armed for queued terminal turns, and route Codex OAuth compaction through OpenAI-Codex. This is the edge case to include in a regression check, especially when the release is pre-release.

The authoritative record is the v2026.5.27-beta.1 GitHub release. The release index gives the surrounding sequence, while the model provider reference supplies the operational background.