OpenClaw 2026.8.1-beta.2 landed 3 hours ago (August 15, 2026). This isn’t a routine patch — it’s a feature-packed beta that touches security, model support, macOS architecture, data durability, and plugin safety all at once.
If you run OpenClaw daily, here’s what actually changed and why it matters.
The Headline Features
1. Secret Egress Host Binding — Security That Fails Closed
What it does: Every shared-store secret (API keys, tokens, credentials) is now bound to exact HTTPS destination hosts across CLI, Gateway RPC, and Control UI.
Why it matters: Before this, a sentinel substitution could leak plaintext secrets to unintended endpoints. Now unbound sentinel substitution fails closed before plaintext egress. If a secret isn’t explicitly bound to a host, it simply won’t be sent — no silent leaks.
Credit: @shakkernerd
Operator impact: Zero-config for most users — your existing secrets keep working. But if you’re building custom integrations or using unusual endpoints, you’ll need to declare the allowed hosts per secret.
2. GPT-5.6 Ultra + Runtime Switching — Sol, Terra, Luna All Supported
OpenClaw now supports the full GPT-5.6 family across both OpenClaw and Codex engines:
| Variant | Codename | Use Case |
|---|---|---|
| GPT-5.6 Ultra | Sol | Maximum capability, complex reasoning |
| GPT-5.6 Pro | Terra | Balanced performance/cost |
| GPT-5.6 Mini | Luna | Speed-optimized, high-volume |
What’s new: Model, runtime, and thinking selection are now atomic through /model and fallback. Live matrix coverage means both harnesses (OpenClaw + Codex) get the same model routing logic — no more “works in one but not the other” surprises.
Credit: @anyech and @vincentkoc
3. macOS App Profiles — True Instance Isolation
This is a structural change for macOS users. Named app instances are now isolated across:
- State (sessions, history, preferences)
- Keychain (credentials, tokens)
- Gateway services (per-profile gateway configs)
- Duplicate-instance ownership (no more conflicts when launching multiple profiles)
What stays shared: Host-global login and node services (so you don’t re-auth everything per profile).
Why it matters: You can now run “work” and “personal” OpenClaw profiles side-by-side with zero cross-contamination. Each gets its own Keychain space, its own gateway connections, its own session history.
Credit: @shakkernerd and @vincentkoc
4. SQLite Backup Snapshots — openclaw backup sqlite
New CLI command family for durable, verified database artifacts:
# Create a snapshot
openclaw backup sqlite create
# List available snapshots
openclaw backup sqlite list
# Verify integrity
openclaw backup sqlite verify <snapshot-id>
# Restore (fresh target only — safety first)
openclaw backup sqlite restore <snapshot-id>Key design choice: Restore only works on a fresh target. This prevents accidental overwrites of live data. Compact, verified, per-agent or global — your call.
Credit: @giodl73-repo
5. Plugin Install Provenance Warnings — Supply Chain Hygiene
Arbitrary executable plugin sources now require explicit --force acknowledgement in both CLI and chat installs.
What stays frictionless (no --force needed):
- ClawHub marketplace plugins
- Bundled/official catalog plugins
- Tracked-update flows (auto-updates from trusted sources)
- Crestodian installs (restricted to trusted sources only)
What now warns you: Random GitHub repos, unverified npm packages, arbitrary URLs. You can still install them — but you have to consciously opt in.
Credit: @jesse-merhi and @vincentkoc
Quality-of-Life Improvements
| Feature | What Changed |
|---|---|
| Control UI Update Recovery | “New version available” reload button now waits for gateway restart and reloads automatically — no more manual hard refresh |
| Channel Plugin Ingress Monitors | Shared SDK monitor for durable admission, polling, pruning, claim validation, adoption handoff, shutdown — IRC, Synology Chat, Google Chat migrated |
| Browser Extension CDP Compat | Answers Target.getBrowserContexts so Puppeteer clients (chrome-devtools-mcp) work without remote-debugging prompt |
| Local Model Setup | Ollama, llama.cpp, LM Studio setup choices advertised to Control UI/macOS; retries unavailable LM Studio services; verifies exact model before success |
| Fish Audio Speech | Hosted S2.1 synthesis with streaming, voice notes, voice discovery, telephony + local Fish S2 Pro reference-voice streaming in native macOS Talk |
| Discord/Slack Native Login | /login in native command menus; pairing-code issuance limited to private chats + Web UI |
| Control UI User Profiles | Trusted-proxy users manage display name/avatar; attributed chat/presence identities via uploaded avatars or private Gravatar proxy |
Installation & Upgrade
# Fresh install (recommended for beta)
curl -fsSL https://openclaw.dev/install.sh | bash
# Or via package managers
brew install openclaw # macOS
# Check GitHub releases for Linux/Windows binaries
# Existing installs
openclaw update # or your package manager's upgrade commandNote: This is a beta release (2026.8.1-beta.2). The team defers Parallels smoke tests to post-publish by default for betas, keeping stable/full prepublish coverage for production tags.
What’s Next
The full curated release notes for the v0.21.0 window will ship with the stable tag. Nothing in this beta window is skipped — highlights, feature areas, and complete contributor credits are coming.
For now, if you’re on macOS and want profile isolation, or you care about secret egress hardening, or you want GPT-5.6 Ultra today — this beta is worth testing.
TL;DR
| Feature | Impact | Effort to Adopt |
|---|---|---|
| Secret egress host binding | 🔒 High security | Zero (auto) |
| GPT-5.6 Ultra (Sol/Terra/Luna) | 🚀 New model tier | /model switch |
| macOS app profiles | 🏗️ Structural | New profile workflow |
| SQLite backup snapshots | 💾 Data durability | New CLI commands |
| Plugin provenance warnings | 🛡️ Supply chain | --force for sketchy sources |
Bottom line: OpenClaw 2026.8.1-beta.2 is a substantial beta — not a polish release. If you run OpenClaw in production, test this in staging first. The secret binding and macOS profile changes are structural enough to warrant a validation pass.
Related articles
- Claude Code Alternatives in 2026: 12 Options Compared
- Beware: Hermes Agent Security Audit Uncovers Credential Bypass, Sandbox Escape, and Session Hijacking in 5 HIGH-Severity Findings
- Oh My Pi v17.3.3 Fixes Gemini Reasoning Loops, Hashline Edge Cases, and TUI Rendering — What Beginners Need to Know
Release: OpenClaw 2026.8.1-beta.2 · Full Changelog · Discord