OpenClaw 2026.8.2 adds a Linux desktop app and widens what sessions see by default
OpenClaw 2026.8.2 was published on September 1, 2026. Two entries in a long set of release notes matter more than the rest: a desktop application for Linux, and a change to what a session may reach by default. Sessions that do not run in a sandbox can now work with other sessions of the same agent unless an operator narrows that. The release also raises the managed Sharp dependency to 0.35.4 with libheif 1.23.2, fixing vulnerabilities in image decoding.
In a long release, the entry that matters most is easy to miss. In OpenClaw 2026.8.2, published on September 1, 2026, that entry is the new default for session visibility. After the upgrade, a session that does not run in a sandbox reaches further than it did before, and nobody has to choose that for it to happen.
A desktop companion for Linux
The Linux build installs as a .deb package or as an AppImage on x86-64 Linux. It connects to a local or remote Gateway, and Quick Chat opens from the system tray or from an X11 keyboard shortcut.
The two install paths update differently, and the notes say so plainly. AppImage updates are signature-verified. A .deb install stays with the system package tooling, which means the machine's existing update and signing policy applies to it unchanged.
A default that opened
Sessions that are not sandboxed can now, by default, work with other sessions of the same agent, retained cron sessions included. The release notes address the consequence directly: an operator running a shared agent should set tools.sessions.visibility to tree or self where narrower access is needed.
Sandbox restrictions and cross-agent restrictions are still enforced, so this is not everything opening to everything. The direction still deserves attention. A default that widens takes effect for everyone who upgrades, while a default that narrows only inconveniences the people who needed the wider setting.
The security entries in this release
Four items concern what leaks or what gets through, rather than what the product can do.
- The managed Sharp dependency moves to 0.35.4 with libheif 1.23.2, fixing vulnerabilities in image decoding while the dependency stays optional.
- Values marked private are redacted in the macOS application logs, and credential values and prefixes are kept out of routine diagnostics.
- Oversized HTTP responses and oversized server-sent events from an MCP server are rejected before parsing, while healthy long-lived streams and keepalives continue.
- Permission changes now apply to runs already under way, and session tool policies are preserved on cloud workers, so moving where work runs does not widen what it may do.
Related
Meta paused Muse sharing after researchers found more than 6,800 shared chats through DNS records
The security firm Claroc found that Muse built each shared conversation's web address from its title, and that passive DNS services recorded those addresses. Among the few hundred pages it opened were loan applications, internal revenue reports, and notes for a confidential call. Meta says sharing is paused while it reviews the findings.
Clarocverified
OpenCode says a breach hit 1.4% of Console users who had linked their own AI providers
OpenCode, the open-source coding agent, announced on October 17, 2026, that attackers had broken into its hosted Console service the night before. The project calls it a large-scale distillation attack and says it affected 1.4% of Console users, all of them people who had connected external providers. Co-founder Dax Raad says the open-source app itself was not involved. How the attackers got in has not been disclosed.
OpenCodeverified
OpenClaw 2026.10.5 blocks plugin hooks from changing tool calls after approval
OpenClaw's new release closes a gap that let an ordinary plugin hook alter a tool call after a trusted policy had already approved it. Such a call is now blocked unless the hook asks for its own approval, which breaks plugins that relied on the old order. The release also makes Gemini 4 Argon the default Google model and points the gemini alias at it.
OpenClawverified