OpenClaw v2026.5.28 Release Summary

Key Changes

Runtime Stability & Recovery

OpenClaw v2026.5.28 introduces significant improvements to the stability of Agent and Codex runtimes. Key enhancements include better separation of current working directories (cwd) and workspaces for subagents, and the implementation of a more robust session lock management system. Specifically, session locks now release on timeout aborts, and live OpenClaw locks are preserved during cleanup to prevent unnecessary teardowns. Additionally, the Codex app-server and helper failures no longer destabilize shared runtime state, ensuring that auxiliary agent spawning does not trigger gateway disconnects.

Expanded Provider & Media Support

Model coverage has expanded with the addition of Claude Opus 4.8 across multiple providers, including Anthropic, Amazon Bedrock, and Google Vertex. The release also adds support for Fal Krea image model schemas and NVIDIA featured model catalogs. For media handling, OpenClaw now utilizes clawpdf for PDF extraction and introduces support for extracting text from encrypted PDFs when a password is provided.

iOS and UI Refresh

The iOS experience has received a major overhaul with the introduction of the iOS Pro UI. This new tab-based system organizes Command, Chat, Agents, and Settings into a streamlined interface. New features include:

• Realtime Talk Tab: Dedicated playback and controls for voice interactions, featuring animated voice UI and echo suppression.
• Hosted Push Relay: Official builds now default to https://ios-push-relay.openclaw.ai for APNs sends.
• WebChat Improvements: Sends are now preserved through reconnects using idempotency keys, reducing message loss during socket instability.

Channel & Plugin Enhancements

• Microsoft Teams: Migrated to the @microsoft/teams.apps SDK, replacing the legacy Bot Framework. This brings native support for streaming cards, Action.Execute card handling, and a simplified SSO sign-in flow.
• Discord: Now supports showing assistant commentary in progress drafts, providing better visibility into the agent's internal reasoning during long turns.
• WhatsApp: Fixed credential leaks across profile boundaries and improved the sanitization of outbound document filenames to prevent header injection.
• Matrix: Resolved a critical bug where room IDs were case-normalized in session keys, which previously caused 403 Forbidden errors during session recovery.

Security & Policy Hardening

New config-level policy conformance checks have been added to allow operators to enforce strict security postures:

• Sandbox Posture: Checks for required modes, allowed backends, and container restrictions (e.g., denying host network access).
• Ingress Conformance: Validates direct-message policies and ensures mention gates are required in group chats.
• Policy Comparison: A new openclaw policy compare command allows comparing a workspace policy against an organization-authored baseline.

Impact

Performance & Resource Management

Several "hot paths" in the Plugin and Gateway layers have been optimized to reduce repeated work. Cache correctness has been improved for install records, config JSON parsing, and tool search catalogs. Additionally, the gateway's provider-auth pre-warming process has been moved to a worker thread, eliminating event-loop stalls during startup that previously caused channel handshake timeouts.

Reliability

• Cron Jobs: Scheduled isolated cron jobs now preflight model fallbacks. If a local primary provider is unreachable, the system will automatically move to a configured cloud fallback instead of marking the run as skipped.
• Claude CLI: Fixed a race condition in transcript probing that previously forced cold session starts, preserving cross-turn context more reliably.
• TUI: Fixed a rendering bug where assistant messages would not paint to the screen until a verbose mode toggle was triggered.

Upgrade Guide

Breaking Changes & Migrations

• Voice Model Configuration: Voice models are now cataloged through providers. Speaker selection configuration has been renamed from voice/voiceName/voiceId to speakerVoice and speakerVoiceId. Users should update their configuration to match the new schema.
• Provider Credentials: Registered provider credential environment variables are now blocked from workspace .env files to prevent local project files from overriding trusted global runtime configurations. Operators who relied on workspace-local credentials should move them to the shell environment or the global OpenClaw .env file.
• Plugin Compatibility: The system now enforces openclaw.compat.pluginApi metadata. Plugins requiring a newer API version than the current host will be rejected at install time with an actionable error message.