OpenClaw 2026.10.2 stops long tool output from slipping credentials past redaction

OpenClaw 2026.10.2, released on October 12, 2026, fixes a flaw that let credentials reach the model unmasked. OpenClaw is an open-source agent that runs tools on the user's machine and masks secrets such as API keys before tool output goes to the model. In long outputs, a key could escape that masking. The release also repairs updates from 2026.10.1, which shipped two days earlier.

How the credentials got through

Before this release, OpenClaw split any text longer than 32,768 characters into slices of 16,384 characters and ran its masking rules on each slice separately. The slices did not overlap. A credential that started near the end of one slice and finished in the next matched in neither, so it went out in clear text.

That text then entered the model's context, which means it was sent to the model provider. The same unmasked text also reached telemetry when content capture was turned on. Long tool output is common for an agent: command output, file contents, and logs can all run past the limit.

The fix scans the full text with the built-in rules instead of slice by slice. According to the author of the fix, texts shorter than 32,768 characters are masked exactly as before. The same change removes two failures: crafted repeated text could stall OpenClaw's main thread for about 6 seconds, and values several megabytes long crashed the masking step outright.

The project has not said whether any credentials actually leaked this way. This suggests that users whose tools return long output containing secrets have reason to rotate those secrets.

Updates from 2026.10.1

The first upgrade from 2026.10.1 now completes cleanly. Before the fix, an in-place update could end in an error even when the new package was installed and the Gateway restarted. On Windows, the update from 2026.10.1 failed after the package swap. The release notes also say Windows, cloned-filesystem, and private Node update paths now finish instead of stalling or rolling back.

Compaction moves to the provider

Compaction shortens a long conversation so it fits in the model's context window. With an OpenAI or Anthropic API key, OpenClaw now asks the provider to do it by default instead of summarizing the conversation itself. For Anthropic this applies only to direct API access; subscription sign-in, Bedrock, Vertex, and proxies stay off. Setting anthropicServerCompaction to false turns it off for Anthropic, and setting responsesCompactEndpoint to false does the same for OpenAI.

The author of the change reports that after Anthropic's compaction, the next turn reads 88% to 89% of its input from the prompt cache, against 44% after OpenClaw's own compaction. Cached input is billed at a lower rate, so the claim, if it holds, means cheaper follow-up turns. It is the project's own measurement.