Openclaw’s rapid-release train continues at full speed. Between May 12 and May 14, the project pushed four beta releases (v2026.5.12-beta.3 through beta.7) — culminating in the most architecturally significant update in recent weeks. While the star count crossed 371,000 and the awesome-openclaw-skills ecosystem reached 48,600+ stars with 5,400+ cataloged skills, the real story is under the hood: Openclaw is deliberately shedding weight from its core distribution.
The Big Shift: Plugin Externalization
The headline change in v2026.5.12-beta.7 is the externalization of major provider and plugin packages. Amazon Bedrock, Bedrock Mantle, Slack, OpenShell sandbox, and Anthropic Vertex have been moved out of the core npm bundle into separately installable plugins.
What this means in practice:
- Smaller core installs — No more AWS SDK dependencies unless you actually use Bedrock. No Slack SDK unless you use Slack. No OpenShell sandbox runtime unless you need it.
- Faster startup times — Reduced dependency resolution at install time means
npm install -g openclawcompletes noticeably faster. - Cleaner dependency trees — Each plugin manages its own runtime dependency cone, reducing version conflicts and transitive-dependency bloat.
This follows the WhatsApp externalization already shipped in earlier betas, where Baileys and its libsignal dependency were moved to a ClawHub-hosted plugin. The pattern is clear: Openclaw’s core is converging toward a lightweight orchestrator that delegates provider-specific logic to plugins.
# Core install is now leaner
npm install -g openclaw
# Add only what you need
openclaw plugins add openclaw/slack
openclaw plugins add openclaw/amazon-bedrock
openclaw plugins add openclaw/anthropic-vertex
openclaw plugins add openclaw/openshell-sandbox
The same release also removes the bundled codex-cli backend, migrating legacy codex-cli/* model refs to the Codex app-server route on openai/* — further reducing the core’s maintenance surface.
Security Hardening: A Coordinated Push
Alongside the architectural changes, the beta cycle ships what appears to be a coordinated security audit response. Over 50 commits carry explicit [AI] tags from contributor @pgondhi987, addressing the kind of plugin security concerns addressing attack surfaces across the gateway, sandbox, and plugin systems:
Sandbox and Execution Hardening
- Windows
USERPROFILEblocked — The sandbox now includesUSERPROFILEin its blocked home roots, preventing credential-bearing binds (.codex,.openclaw,.ssh) under Windows user profiles from leaking into sandboxed execution. - Exec provenance validation — Node exec events are validated for provenance before dispatch, and truncated exec approval commands are rejected at the gateway boundary.
- Shell wrapper payload matching — Inline shell wrapper payloads are now strictly matched, preventing injection through malformed command wrappers.
Authentication and Scope Control
- No more accidental env-var credentials — The provider auth system no longer infers environment-variable markers from broad regex patterns. Provider API keys are resolved only through structured
secrets.providers[id]andsecrets.defaultssecret references. - Bootstrap pairing locked down — Device-token scopes can no longer be escalated during bootstrap pairing, and admin scope is now required for node device token management.
- Gateway scope enforcement — Gateway command scopes are enforced by caller context, and browser CLI explicitly requests
operator.adminscope instead of relying on implicit scope-upgrade loops.
Channel Security
- Slack reaction policy — Reaction notification policy is now enforced server-side.
- Rate limiting — Google Chat webhook requests are now rate-limited, and Feishu webhook rate-limit client keys are normalized.
- Media validation — Multiple channels (iMessage, Telegram, WhatsApp, Microsoft Teams) now reject malformed inline attachment data before processing, preventing silent data corruption.
This level of coordinated security work suggests Openclaw is preparing for enterprise adoption where audit trails, sandbox isolation, and credential management are non-negotiable.
Gateway Protocol v4
The beta cycle introduces Gateway Protocol v4, which requires v4 clients and streams explicit deltaText and replace frames. This is a meaningful change for SDK and tooling developers:
- No more local diffing — Chat assistant updates now arrive as explicit deltas instead of requiring clients to compute diffs against previous state.
- Deterministic streaming —
replaceframes give SDK consumers a clear contract for how to render incremental assistant output. - Backward compatibility — v3 clients continue to work through a compatibility shim, but the protocol version is now enforced at the gateway handshake.
For the broader agent ecosystem, this positions Openclaw’s Gateway as a stable, well-specified protocol that third-party tools and dashboards can build against with confidence.
ACP Fallbacks: Resilient Agent Orchestration
A smaller but significant change: the ACP (Agent Control Protocol) now supports acp.fallbacks, allowing ACP turns to try configured backup runtime backends when the primary backend is unavailable — before any output is emitted. This means:
- If your primary Claude ACP backend is down, the turn can automatically fail over to an OpenAI Codex backend
- Fallback happens silently before the user sees any response, keeping the experience seamless
- Each fallback tier can have its own timeout and model configuration
Control UI and Quality-of-Life Improvements
The Control UI received several notable upgrades:
- Persisted auto-scroll mode — Users can now choose between “always follow streaming output,” “stay near bottom,” or “manual scroll only” — with the preference saved across sessions.
- Session nesting — Subagent sessions now appear nested under their parent session in the session picker (
└─visual prefix), making agent hierarchies clear at a glance. - Compact session badges — Live/idle/terminal run status badges are now one-liners in the Sessions table.
The Big Picture
Openclaw’s trajectory in this beta cycle reveals a project maturing along multiple axes simultaneously:
| Dimension | Direction |
|---|---|
| Core size | Shrinking via plugin externalization |
| Security posture | Hardening with enterprise-grade sandboxing |
| Protocol | Standardizing with Gateway v4 |
| Resilience | Improving with ACP fallbacks |
| Ecosystem | Growing with 48.6K awesome-skills stars |
| Authentication | Tightening with structured secret refs |
With 371,000+ GitHub stars and over 7,200 open issues (testament to both its popularity and the community’s engagement), Openclaw is no longer just the open-source AI agent with the most stars — it’s becoming a proper infrastructure platform with the architectural rigor to match its explosive growth.
Openclaw v2026.5.12-beta.7 is available now via npm install -g openclaw. Full changelog on GitHub.