# OpenClaw 2026.6.6-beta.2: fail-closed security boundaries, OpenRouter OAuth, Claude Fable 5

> Release-candidate prerelease carrying the full 2026.6.6 notes. Transcript, sandbox, MCP, browser, channel, and exec-approval paths now fail closed on unsafe access and timed-out approvals; provider support adds OpenRouter OAuth and Claude Fable 5. Default compaction timeout drops to 180 seconds unless explicitly configured.

| | |
|---|---|
| **Tool** | OpenClaw |
| **Version** | v2026.6.6-beta.2 |
| **Kind** | release |
| **Published** | 2026-06-12 |
| **Observed** | 2026-08-11 |
| **Significance** | 3/5 |
| **Breaking** | no |
| **Categories** | security, model-support, fix, feature |

## What changed


- Security: transcript, sandbox, MCP, browser, channel, and exec-approval paths fail closed around unsafe access, timed-out approvals, and malformed boundary input; transcript images redacted; browser and LanceDB memory media directives neutralized
- Providers: OpenRouter OAuth, Claude Fable 5, Gemma 4 reasoning replay, local model execution, normalized tool progress; local llama.cpp runtime moved into its provider plugin
- Default compaction timeout lowered to 180 seconds; explicit configuration still respected
- Telegram: account-scoped topics route to the correct agent, streamed text survives tool calls, unauthorized DM text is kept out of cache and prompt context
- iMessage: always-on inbound recovery, durable echo markers, block streaming, and outbound transport survive restarts and idle periods
- Startup: Control UI no longer waits on broad model loading; cached model metadata, lazy slash-command work, first-assistant-event traces and slow-first-reply warnings
- Channel fixes: WhatsApp captured replies reattach to the successor controller after restart, Feishu rate-limit retries, Mattermost thread replies, canonical LINE webhook paths, Discord reply hydration, OpenAI Realtime WebRTC transcripts
- Gateway/config: shared approval runtime socket token, explicit array replacement in `config.patch`, SQLite auth migration verified before cleanup
- Channels/mobile: QQBot group mention toggle, iPad/iPhone control surfaces, active connection host in the TUI footer


## Sources

- [github_release](https://github.com/openclaw/openclaw/releases/tag/v2026.6.6-beta.2) — retrieved 2026-08-11

## Community

_No curated reactions recorded. Facts and community takes are kept in separate layers
and never blended._

---
Canonical: https://changelogs.info/openclaw/v2026-6-6-beta-2
Entity: https://changelogs.info/openclaw
Event ID: `evt_2026-06-12_openclaw_v2026-6-6-beta-2`
Licence: event synthesis © changelogs.info, CC BY 4.0. Linked sources belong to their vendors.