Here’s the bottom line up front. Between February 10 and March 2, 2026, OpenClaw shipped fourteen releases in three weeks — a dense stretch that includes the introduction of External Secrets, a major security patch wave, a native macOS app, and five separate breaking changes. This piece merges three posts we’d previously split the coverage across into one comprehensive OpenClaw update guide, covering the same window once, with nothing repeated and nothing missing.

🔍 Overview — Three Weeks of Cascading Releases

From 2026.2.17 through 2026.3.2, OpenClaw shipped releases almost daily. Working with this tool every day, I put together this roundup around the changes that actually show up in day-to-day use. The full CHANGELOG runs hundreds of lines; this piece keeps only what an operator actually needs to know.

We’d previously covered this window across three separate posts. The first was a short recap of just the fourth week of February. The second swept back over all of February. The third covered late February through early March in a migration-guide format. Laid side by side, some releases turned up in more than one post, while others didn’t get proper coverage anywhere. This time, we merged all three into one — the full February 10 to March 2 window, in date order, with nothing duplicated.

📅 Version Timeline

OpenClaw uses CalVer (YYYY.M.D). Here’s this window’s releases at a glance.

The heaviest-weight release here is 2026.2.26. With External Secrets, the era of writing plaintext API keys straight into config files ended. 2026.2.23‘s security megapatch and 2026.3.1‘s Android node expansion are the other two releases worth dwelling on.

⭐ Key New Features

Three weeks produced a lot of new capability. Here’s the breakdown.

Korean/Japanese memory search improvements (2.22) — Memory search (FTS) gained Korean particle-splitting and mixed Korean-English keyword extraction. Matching used to fall apart on queries with particles attached; now natural Korean sentences find the right memories reliably. Japanese mixed-script (ASCII+katakana) tokenization and Spanish/Portuguese/Arabic stop-word filtering shipped alongside it.

Gemini 3.1 Pro Preview (2.21) — Google’s new model is available directly under the model ID google/gemini-3.1-pro-preview. With Google discontinuing Gemini 3 Pro in favor of 3.1, this is effectively a mandatory update for anyone on Antigravity auth. The same version added the Volcano Engine (Doubao) and BytePlus providers.

Provider expansion — Mistral joined Anthropic, Google, OpenAI, and xAI as an official provider (2.22, including memory embeddings and voice support). Kilo Gateway also landed as a full integration — onboarding auto-detection, model defaults, and cache TTL handling included (2.22–2.23).

Synology Chat channel (2.22) — A native channel for Synology NAS users, supporting webhook ingestion, DM routing, media delivery, and per-account configuration.

Anthropic 1M-context beta (2.17) — Claude Opus/Sonnet can now use a million-token context window, enabled via params.context1m: true in agent config. Useful for passing entire long documents or retaining large conversation histories. The same version formally registered anthropic/claude-sonnet-4-6 in the alias/fallback chain, and added the /subagents spawn command for spinning up subagents mid-chat.

Apple Watch companion MVP (2.21) — Inbox checks, notification relay, and gateway commands are now available from the watch. On Android, the native 4-step onboarding was replaced with a 5-tab shell, system integrations like system.notify/photos.latest/contacts.search/calendar.events/motion.activity shipped, and streaming delivery plus GFM markdown rendering quality were both refined.

Multilingual auto-stop command expansion (2.25) — Beyond English phrases like “stop openclaw” and “please stop,” stop keywords now cover Korean, Japanese, Chinese, Spanish, and French, and trailing punctuation like “!” or “?” is accepted too.

🔐 External Secrets Management — The Biggest Shift

This is 2026.2.26’s headline change. If you’d been putting API keys straight into config.yaml as plaintext, there’s now a dedicated secrets workflow via the openclaw secrets CLI.

First, scan your current config for any exposed secrets.

openclaw secrets audit

If exposed keys turn up, you can auto-generate a migration plan.

openclaw secrets configure

This command writes the migration plan to /tmp/openclaw-secrets-plan.json. Always check it with --dry-run before applying.

# dry-run first to confirm
openclaw secrets apply --from /tmp/openclaw-secrets-plan.json --dry-run

# apply for real once it looks right
openclaw secrets apply --from /tmp/openclaw-secrets-plan.json

To swap secrets after applying without restarting the service, use hot-reload.

openclaw secrets reload

🤖 ACP Thread-Bound Agents & Agent Routing CLI

ACP (Agent Communication Protocol) agents were promoted to first-class citizens of thread sessions (2.26) — meaning an agent now binds to a specific conversation thread and gets its lifecycle (spawn, cleanup, rebalancing) managed systematically. ACP spawn/send now integrates with ACPX backend bridging, coalesced thread replies merge multiple responses into one, and subagent-to-subagent communication reliability improved significantly.

A new CLI for managing agent bindings landed around the same time, letting you upgrade from channel-scoped bindings to account-scoped ones.

# view current bindings
openclaw agents bindings

# add an account-scoped binding
openclaw agents bind

# remove a binding
openclaw agents unbind

⚡ Five Breaking Changes You Can’t Afford to Miss

Five breaking changes came out of this three-week window. Miss even one, and something in your setup can break.

1. Heartbeat DM policy change. This is the one that caused the most confusion.

The default flipped to block in 2.24, then flipped back to allow in 2.26. If you want to keep DMs blocked, you now have to set that explicitly.

# add to config.yaml
agents:
  defaults:
    heartbeat:
      directPolicy: "block"

2. Browser SSRF default change (2.23). The default browser SSRF defense flipped to trusted-network. If you’re running OpenClaw on a private network, you’ll need to set this explicitly. The relevant config key also changed to browser.ssrfPolicy.dangerouslyAllowPrivateNetwork. The simplest fix is openclaw doctor --fix.

openclaw doctor --fix

3. Branding change — LaunchDaemon label. The macOS LaunchDaemon label changed from bot.molt to ai.openclaw, with the logging subsystem and bundle ID changed to match.

# check the change
launchctl list | grep openclaw

4. Podman binding change. The default bind changed from lan to loopback. For a stretch right after the 2026.2.26 upgrade, instances that had previously been set to bind=lan didn’t auto-migrate to the new security requirement and could enter a crash loop — reported in GitHub #29385.

5. onboarding –reset scope change. The default reset scope changed to config+creds+sessions. If you need a full reset, you now have to specify --reset-scope full explicitly.

🛡️ Security Patches, All in One Place

A substantial number of security fixes landed over these three weeks. Here’s a date-by-date rundown, centered on the 2026.2.23 megapatch.

2026.2.23 megapatch — automatic removal of LD_*/DYLD_*/SSLKEYLOGFILE environment variables, Unicode NFKC normalization defending against hook-bypass attacks, Telnyx webhook replay detection (Voice Call), sandbox tmp paths restricted to the OpenClaw root, plugin HTTP API path normalization, node-pairing device metadata signature binding, automatic redaction of dynamic env.* keys in config snapshots, explicit approval now required for obfuscated command execution, workspace filesystem @-prefix path escape prevention, blocking media downloads over Telegram before authentication, and a fix for Anthropic OAuth PKCE verifier exposure.

Additional patches, 2026.2.25–26 — hardened execution approval (symlink cwd rejection, argv normalization blocking path-swap attacks), per-channel reaction authorization (Signal/Discord/Slack/Telegram now respect DM/group policy — previously, reaction events could be injected without authorization), Gateway WebSocket cross-origin brute-force/session-hijack prevention, workspace filesystem sandbox-escape prevention via hardlinks/symlinks, IPv6 multicast address blocking added to the SSRF guard (a separate item from the default-policy change in Breaking Change 2 above), and removal of a macOS beta OAuth PKCE verifier exposure vulnerability. Counted individually these look like scattered patches, but together they hardened four axes at once: execution approval, channel authorization, sandbox isolation, and network defense.

Worth keeping the CVE list handy too. CVE-2026-26324 (SSRF bypass via IPv4-mapped IPv6, CVSS 7.5 HIGH, fixed in 2026.2.14+) is the only verified CVE from this window. As a side note, the “BlueBubbles loopback auth bypass” CVE that our earlier posts cited turned out, on re-verification, to be a Rejected CVE number — we’ve dropped that item from this consolidated revision.

🧩 Claude Opus 4.6 Adaptive Thinking

As of 2026.3.1, adaptive thinking is enabled by default for the Claude Opus 4.6 model. This is OpenClaw automatically applying Anthropic’s extended thinking (the same feature family now marketed as Adaptive Thinking), Bedrock deployments included. Other reasoning models keep their existing “low” setting. If Claude Opus 4.6 is your agent backend, this applies automatically with no extra configuration.

📱 Platform-by-Platform Changes

macOS — The native app finally shipped in 3.2, with Sparkle-framework-based auto-updates. This release also includes a binary-first gateway (minimizing Node.js dependency), a menu bar icon fix, rounded-corner WebChat UI, graceful voice-wake shutdown, a CJK IME Return-key fix (the Enter-key issue on Korean/Japanese/Chinese input finally resolved), and restart-loop fixes (supervisor marker, stale PID, a 60-second ThrottleInterval).

Windows — PowerShell 7 (pwsh) now runs first, falling back to PS 5.1. The && chaining bug was also fixed.

Android — The native 4-step onboarding was replaced with a 5-tab shell (Connect, Chat, Voice, Screen, Settings). System integrations like system.notify, photos.latest, contacts.search/add, calendar.events/add, and motion.activity/pedometer were added, and streaming delivery plus GFM markdown rendering quality improved. Startup performance was also optimized — delayed foreground-service start and moving WebView debugging off the critical path.

watchOS — The Apple Watch companion MVP is new here: inbox checks, notification relay, and gateway commands from the watch. It’s still MVP-stage, not a final release, so if you’re planning to make the watch your primary channel, treat it as a secondary channel for now.

⚙️ Stability & Delivery Improvements

Alongside the headline features, this window also brought in a lot of real-world stability work.

Subagent delivery — completion-notification dispatch was refactored into an explicit queue/direct/fallback state machine, preventing duplicate sends under uncertain delivery states. Discord typing indicator — fixed the “typing…” indicator that used to keep showing after a message had already been sent. Slack session threads — fixed a bug where an oversized parent session could send a new thread into an infinite loading state. Model fallback chain — overhauled to make fallback actually work correctly on rate limits, cooldowns, and unknown errors.

Gateway stability — the “already running” lock issue after an abnormal shutdown is significantly reduced. Gateway port reachability is now used to determine stale-lock status, making restarts after a sudden crash much smoother. An edge case in the restart loop was also fixed — previously, under certain conditions, the gateway could cycle between dying and reviving repeatedly, burning CPU the whole time. If you’re running this in an always-on environment, this is a change you’ll actually feel.

Cron-related improvements — a new cron.maxConcurrentRuns setting lets cron jobs run in parallel (previously always serial). 3.1 also added a --light-context option that skips bootstrap file injection on Cron/Heartbeat runs.

# load only HEARTBEAT.md on Heartbeat
openclaw heartbeat --light-context

For automation work — especially cron jobs that run frequently — the token savings add up.

Auto-updater — auto-updates can now be turned on via update.auto.* settings. Off by default; the stable channel uses rollout delay plus jitter, and beta uses an hourly update cadence. Per-agent cache tuning — parameters like cacheRetention can now be overridden individually per agent.

⚔️ How OpenClaw Stacks Up Against the Competition

Here’s an objective look at OpenClaw’s positioning.

OpenClaw’s strength is its scalability as a general-purpose AI agent platform. If you need something lighter, ZeroClaw is worth a look; if security is the priority, consider NanoClaw — but in ecosystem scale, OpenClaw is well ahead. That said, this table is a positioning map, not a leaderboard. The right question isn’t which tool is “better” — it’s which axis is actually closest to the problem you’re trying to solve.

✅ Migration Checklist

Here’s the actual update sequence. Run these in order, top to bottom.

1. Preview the update — openclaw update --dry-run
2. Audit plaintext API keys — openclaw secrets audit
3. Auto-diagnose SSRF/migration issues — openclaw doctor --fix
4. Run a security audit if you’ve ever installed a ClawHub skill — openclaw security audit --deep
5. Check the LaunchDaemon label — launchctl list | grep openclaw
6. Check your Heartbeat DM policy — set directPolicy explicitly in config.yaml if needed
7. Evaluate whether to apply --light-context to your cron jobs
8. Confirm Claude Opus 4.6 adaptive thinking is behaving as expected
9. Check your agent routing — openclaw agents bindings

🧭 Wrapping Up

Three weeks of change, summed up in one line: tighter security, modernized secrets management, and multiplatform expansion.

The three things that matter most: first, clean up plaintext keys with External Secrets — this isn’t optional anymore, it’s the required direction. Second, don’t miss any of the five Breaking Changes (Heartbeat DM, SSRF, branding, Podman binding, reset scope) — a single openclaw doctor --fix resolves most of them. Third, we’d recommend applying this window’s security patches immediately. Work through the nine steps in the checklist above in order, and the update should go smoothly.

Consolidating three weeks of backed-up releases into one piece left us with a takeaway: for a project that ships as fast as OpenClaw, chasing every individual CHANGELOG entry isn’t realistic — a periodic, window-based roundup like this one is the more sustainable approach. If the next stretch piles up at a similar density, we’ll be back with another one.

🔄 So Where Does That Leave Us Now? (As of July 2026)

Everything above stopped at March 2nd. It’s July 19th today — four and a half more months have passed. OpenClaw kept shipping the whole time, and we’re appending the items our readers shouldn’t miss right here. This section will keep getting updated after this piece goes live, and every item in it comes from a release page we opened and checked directly, not a list view.

The March critical security cluster (3.11–3.31) — Over the course of March, a run of critical privilege-escalation vulnerabilities (CVSS 9.8–9.9) were discovered and fixed in quick succession. The common pattern: a caller entering with a lesser scope (operator.pairing, operator.read) could escalate to operator.admin, and in deployments with connected node hosts, this could extend to remote code execution on the node.

Also worth noting: two large batches of security advisories landed on May 28 and June 30 — 67 and 45 respectively. The numbers alone shouldn’t alarm you. Both batches are large-scale disclosures OpenClaw’s own security team retroactively applied back across older version ranges — mostly a matter of affected-version ranges being backdated, not 67 vulnerabilities newly breaking on that one day. They line up with the “tighter security boundaries” line items in the 2026.5.27 and 2026.6.6 release notes and read as routine housekeeping. What actually matters for our readers is the March cluster in the table above — it’s critical-severity, newly discovered, and has a clear fix version.

Memory becomes a “people-aware wiki” (2026.4.29) — The memory system expanded significantly: provenance views, per-conversation Active Memory filters, partial recall on timeout, and REM preview diagnostics. The same release also made a security-relevant change — granular settings like tools.exec/tools.fs no longer implicitly loosen restrictive profiles like messaging/minimal. If you need that behavior, you now have to add an explicit alsoAllow entry.

A full Control UI overhaul (2026.7.1, actually published 7/13) — The tag says “7.1,” but it actually published on July 13th — a 12-day gap, well beyond the roughly one-day tag/publish offsets we’ve seen elsewhere in this piece so far. That looks to be because betas 1 through 6 rolled out sequentially from 7/2 to 7/13. The content itself is the biggest release in this window: a Tasks-centered Control UI redesign, side-by-side conversation views, guided setup with connection pre-validation, substantial work across iOS/iPadOS, Android, and macOS, openclaw attach (temporarily handing a session to Claude Code), more reliable Codex delegation and native subagents, new models including GPT-5.6 and Tencent Hy3, and a change that gives a repeatedly-failing Gateway a stable recovery path instead of endless restarts.

Worth a note: the native iOS app has been continuously refined throughout this window (App Store Connect prep, TestFlight betas, CalVer pinning, and more), but within what we could verify, we didn’t find an official general-availability launch announcement. It’s more accurate to treat it as still in beta.

📚 References

• OpenClaw GitHub Releases
• CVE-2026-26324 — SSRF via IPv4-mapped IPv6
• GitHub #29385 — bind=lan crash-loop after 2026.2.26 upgrade (fixed in 2026.3.1–3.2, see in-article correction)
• Anthropic Extended/Adaptive Thinking Documentation
• Our deep dive — Is OpenClaw Safe If You Keep It Local?
• GHSA-4jpw-hj22-2xmc — device.token.rotate privilege escalation
• GHSA-hf68-49fm-59cq — device.pair.approve privilege escalation
• GHSA-fqw4-mph7-2vr8 — local shared-auth reconnect privilege expansion
• GHSA-9hjh-fr4f-gxc4 — backend-label reconnect self-claimed admin
• GHSA-g5cg-8x5w-7jpm — Heartbeat context inheritance sandbox bypass
• GHSA-9p3r-hh9g-5cmg — remote FS bridge TOCTOU sandbox escape
• OpenClaw v2026.4.29 release notes — memory becomes a wiki
• OpenClaw v2026.7.1 release notes — Control UI overhaul