OpenClaw 2026.11.2 stops project settings from adding programs to the agent's PATH

OpenClaw, the open-source agent that runs tools on the user's own machine, released version 2026.11.2 on November 8, 2026. The project describes it as a patch release with no new features. Its most important change concerns security: at startup, the command-line tool no longer adds programs from inside the current workspace to the PATH of the processes it launches. PATH is the list of directories in which the system looks for a program when a command calls it by name.

What the security fixes close

Until this release, a .env file in the workspace could set MISE_DATA_DIR or XDG_BIN_HOME, two variables that tell OpenClaw where tools installed through the mise version manager or the XDG directory layout live. When those locations pointed inside the workspace, OpenClaw added them to the PATH of the processes it started. In 2026.11.2, workspace .env files can no longer set these variables, and relative or workspace-contained tool directories are rejected. Trusted absolute directories outside the workspace still work.

This suggests a concrete risk for anyone who opens a project they did not write: a file in that project could influence which program ran when the agent called a tool by name. The project does not say whether the problem was exploited.

The release also fixes several narrower problems:

• openclaw config set could write a new secret in readable form to the local audit history when the --expect-current-json option came before the setting or between the setting and its value. New entries are now masked, but existing audit records are not rewritten.
• Sandboxed agents could run a third-party web search provider that the sandbox trust policy excludes. Sandboxed search now accepts only bundled or verified official providers, as web fetch already did.
• A grant for Model Context Protocol (MCP) tools stayed active after a turn finished on a reused command-line process. It is now released when the turn ends.
• A local Gateway password stored as a secret reference was ignored when only a remote-client token was configured.
• Assistant replies, message previews, and output from bundled language servers are no longer copied into several debug and delivery logs.

What users may have to change

Two of the fixes change behavior that existing setups may rely on. Users who keep mise or XDG tool directories inside a workspace must move those installations outside it, or OpenClaw will no longer find the tools there. Sandboxed agents configured with an excluded third-party search provider lose web search until an eligible provider is enabled or selected, and the error message names that step.

The release also repairs updates. It fixes updates that failed during snapshot checks when the update history was overloaded, and the project says installations of 2026.10.4 affected by that failure can follow its update recovery guidance. Scheduled reminders whose text mentioned heartbeat polls or wakes no longer disappear. According to the release notes, the version draws on 113 pull requests from 64 GitHub accounts.