OpenClaw 2026.9.1 rolls back a failed update and adds a host blocklist to its SSRF policy

OpenClaw published 2026.9.1 on September 3, 2026. The release notes are long, but three items in them change what an operator actually does. An update that fails no longer leaves the machine half-migrated. The SSRF policy can be given a list of hosts to refuse. Diagrams written as Mermaid blocks are drawn in the chat window instead of being shown as code.

The update path is the headline

A failed upgrade used to be able to leave a machine between two versions. In 2026.9.1 the update rolls back the npm candidate when the Doctor run that follows it fails, and the configuration and the secret references survive that failure. Failures are handed to a built-in triage agent, and the restart waits for plugins to report ready instead of racing them.

Two behaviors changed for people running without a service manager. The update now proceeds without a Gateway service rather than refusing, and an update launched by an agent is allowed to finish outside the Gateway process tree. Local npm archives from npm 12 are accepted.

• Anyone still on 2026.8.2 without a service manager should run the update once with restarts disabled.
• Interrupted credential migrations recover, and credentials replaced during cleanup are preserved.
• Gateway startup survives large agent rosters, and malformed legacy cron rows are quarantined instead of blocking boot.

What the security fixes cover

The SSRF policy gains a blocked-hostnames setting, and it applies to the browser, to web fetches, and to webhooks. Those are the three places where the assistant reaches out on someone else's behalf, and the list is something an operator writes rather than something the tool guesses.

Several fixes close paths by which a secret could leave in plain text. Reading the configuration no longer returns unredacted pre-migration snapshots, systemd unit backups no longer carry Gateway tokens, and the iOS app keeps deep-link URLs out of its logs.

• Commands stop reaching a Watch node once its device has been revoked.
• The Copilot Azure BYOK proxy now requires the per-process nonce.
• Webhook rate limits are isolated per client, and oversized A2A JSON-RPC batches and responses are rejected.

Diagrams, a shorter first run, and personal skills

Mermaid blocks now render as diagrams in the Control UI and in the native macOS, iOS, and Android apps, with an enlarged preview and a retry when a diagram fails to draw on mobile. The use is obvious enough: an agent that explains a system can now show it rather than print it.

A fresh install, npx openclaw@latest included, gets a quick-start lane that detects an existing Claude Code or Codex login and any API keys, verifies them live, and opens the web dashboard from a foreground Gateway; the full wizard stays available as Custom setup. On a shared Gateway, personal skill libraries now sit beside the workspace set, can be imported from ZIP archives, and can be shared or published per identity.

Models and configuration

The release adds Anthropic Fable 5.1 through shared model metadata, shows SuperGrok usage in the model list and the usage panel, keeps GPT-5.6 Ultra selected across runtime boundaries, and keeps Sonnet 5 pricing current on Vertex. Local providers were tidied up as well: llama.cpp models behind web-app endpoints are discovered, and model catalogues refresh after an auth or config change without a restart.

On the configuration side, missed recurring jobs can be skipped at startup with cron.skipMissedJobs, a channel switched off with enabled: false no longer loads its plugin at all, and config set accepts guards that fail the write when the current value is not what the caller expected. Agents can be given a default working directory, a global worktree root, and up to 100 managed checkouts.