OpenClaw 2026.4.8/4.9 Ships, Anthropic Cuts Claude Access, and Fresh CVEs Keep Coming

Release

OpenClaw 2026.4.8 Released: Build Tool Env Injection Patched, ClawHub Archive Integrity Added

Version 2026.4.8 landed April 8-9 and closes the build-tool environment variable injection bug (HGRCPATH, RUSTC_WRAPPER, CARGO_BUILD_RUSTC_WRAPPER, MAKEFLAGS missing from the exec-env denylist) that let a malicious skill or crafted API request hijack subprocesses. Critically, it also adds SHA-256 verification for ClawHub plugin archives and fails closed on missing integrity metadata, which is the first real supply chain control the marketplace has shipped. If you are self-hosting, this is your current floor — get here before anything else. github.com

OpenClaw 2026.4.9 Out: Agent Control Token Leakage Fixed, Auth Profile Writes Hardened

Hot on the heels of 4.8, version 2026.4.9 patches a subtle but nasty issue where internal agent-to-agent control tokens (ANNOUNCE_SKIP, REPLY_SKIP sentinels) were leaking into user-facing gateway chat surfaces. Auth profile upserts were also skipping proper persistence, which could leave stale credentials in place. Two releases in two days signals the team is in active fire-fighting mode, not routine cadence. newreleases.io

OpenClaw 2026.4.7 Adds Claude CLI Security Hardening to Block Silent Config Hijacking

The 2026.4.7 release shipped three targeted Claude CLI security fixes: clearing inherited CLAUDE_CONFIG_DIR and plugin-root env overrides so OpenClaw-launched Claude CLI runs cannot be silently redirected to a malicious config tree, and forcing host-managed runs to user-only settings sources to prevent repo-local hooks from executing inside non-interactive sessions. These are quiet but meaningful fixes for anyone running OpenClaw as an orchestrator that spawns Claude CLI subprocesses, a pattern that is increasingly common in agentic pipelines. releasebot.io

News

Anthropic Kicks OpenClaw Off Claude Subscriptions, Forces Pay-As-You-Go

As of April 4, Anthropic removed OpenClaw from standard Claude subscription limits, requiring users to pay per-token for any OpenClaw-driven Claude usage. OpenClaw's creator Peter Steinberger publicly pushed back, saying he and board member Dave Morin "tried to talk sense into Anthropic" but only managed a one-week delay. For teams running OpenClaw at scale with Claude as the primary model, this is a real cost structure change that needs to be priced into your stack today. techcrunch.com

Mainstream Coverage of CVE-2026-33579 Picks Up, Exec Bans Spreading

AndroidHeadlines' writeup of CVE-2026-33579 is reaching a broader consumer audience and includes the detail that some tech executives are now banning OpenClaw outright on company laptops due to its unpredictable attack surface. The 48-hour gap between the patch dropping and the NVD listing is getting traction as a systemic problem for teams relying on automated scanner alerts rather than watching GitHub advisories directly. If you have not yet communicated the patch status to non-technical stakeholders, this coverage will do it for you. androidheadlines.com

Security

New High-Severity CVE: Build Tool Env Variable Injection via Missing Exec Denylist Entries

A freshly disclosed High-severity CVE covers four build-tool environment variables (HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, MAKEFLAGS) that were absent from OpenClaw's exec-env denylist, letting any attacker who can set env vars on the process — via a crafted API request or malicious skill — hijack cargo, make, or Mercurial builds to run arbitrary code. This is the same class of incomplete-fix problem that produced CVE-2026-4039 earlier in the week: a previous denylist patch missed injection vectors, and now another pass was needed. The pattern is the problem. dailycve.com

New CVE: Allowlist Cross-Channel Write Lets Non-Owner Users Hijack Other Channels

Another authorization bypass landed in the last 24 hours: the /allowlist command handler checks whether a sender can issue commands at all, but skips the owner check for cross-channel write targets. Any command-authorized user can write allowlist entries against channels they do not own, granting themselves persistent access to resources they should never touch. This makes six authorization-boundary CVEs in roughly six weeks all touching the same class of missing ownership enforcement, which at this point is not a bug count problem but an architectural one. Patch target is version 2026.4.8. dailycve.com

Analysis

OpenClaw 2026.4.9-beta.1 Previews Zero-Trust Security Architecture and Biomimetic Memory Overhaul

Beyond the security patch train, a beta signals the next major architectural direction: a "zero-tolerance security" posture baked into the runtime alongside a rebuilt memory system that promotes diary entries into long-term agent memory via a dreaming subsystem. Over 30 changes span memory management, mobile, plugins, and developer tooling. This is the first signal that the team is trying to get ahead of security by design rather than just patching CVEs reactively, which is worth watching. xugj520.cn