OpenClaw v2026.4.14: GPT-5.4-Pro Support, Telegram Topics & 50+ Security Fixes

Published April 14, 2026 · 6 min read

OpenClaw v2026.4.14 shipped today with forward compatibility for OpenAI's new GPT-5.4-Pro model, surfaced Telegram forum topic names inside agent context, a critical UI markdown security patch (marked.js → markdown-it), and more than 50 bug fixes spanning WhatsApp, Telegram, Teams, Feishu, Discord, voice notes, session memory, and Ollama streaming. Here's what matters for B2B export teams running AI-assisted sales sequences.

What's New

GPT-5.4-Pro: Forward Compatibility Before the Catalog

OpenClaw now ships pricing, token limits, and visibility metadata for gpt-5.4-pro ahead of OpenAI's upstream catalog update (PR #66453). This means your agent won't break when you switch your provider config to the new model — the routing, cost accounting, and context-limit guards are already wired in.

What this means for SDR teams: Teams using OpenAI for multi-turn qualification sequences can switch to gpt-5.4-pro without waiting for an OpenClaw update. The model's expanded reasoning capability translates directly to better objection handling and more coherent multi-step follow-ups across long sales threads.

OpenAI's gpt-5.4-pro delivers ~40% better multi-step instruction-following versus gpt-4o on complex sales qualification prompts (internal benchmark, 2026).

Telegram Forum Topics: Human-Readable Context

B2B teams running Telegram-based outreach into group channels now get a meaningful upgrade: OpenClaw learns topic names from Telegram forum service messages and surfaces them as human-readable context in both agent replies and plugin hook metadata (PR #65973).

Previously, the agent saw only a numeric topic ID — essentially noise for any prompt that tried to route or filter by conversation context. Now it sees the actual topic name (e.g., "Q2 Prospects – Germany", "Inbound Leads", "VIP Accounts") and can factor it into routing logic, persona selection, and CRM tag assignment.

B2B SDR relevance: Telegram remains the dominant async sales channel in export markets across Southeast Asia, Eastern Europe, and the Middle East. Forum-structured groups — where each topic is a separate deal stage or territory — are the standard operating model for many export desks. With topic-name awareness, your agent can now apply stage-appropriate messaging without manual routing rules.

Security: What You Should Patch Now

UI Markdown: marked.js → markdown-it (XSS Fix)

The most important fix in this release from a security standpoint: the control UI's markdown renderer has been switched from marked.js to markdown-it, eliminating a class of XSS vulnerabilities that could be triggered by agent-generated or user-supplied content in the web UI.

Recommendation: If you run OpenClaw's web UI exposed on a local network or behind SSO, upgrade to v2026.4.14 immediately. The attack surface is low in most self-hosted configurations, but any deployment where the UI is reachable by untrusted users should treat this as a required patch.

Browser SSRF Enforcement + Attachment Path Canonicalization

Two additional security fixes ship in this release:

• Browser SSRF policy: Navigation and screenshot/snapshot requests now enforce the outbound SSRF policy, preventing a sandboxed browser tool from probing internal network addresses.
• Attachment path canonicalization: Attachment paths are now canonicalized before processing, blocking a path-traversal vector in file-handling workflows.

Both fixes apply to self-hosted deployments. Cloud-hosted PulseAgent instances are already patched.

Channel & Integration Fixes

WhatsApp: Media Encryption Handling

WhatsApp media decryption now handles edge cases in the encryption key derivation, fixing a silent failure that caused some inbound media (voice notes, images, documents) to be silently dropped rather than surfaced to the agent for processing.

Impact for SDR sequences: Voice notes from prospects — common in WhatsApp-heavy markets like Brazil, India, and Southeast Asia — are now reliably transcribed and routed. Product catalog PDFs sent by distributors will no longer disappear.

Microsoft Teams: SSO Allowlist Checks

Teams SSO flows now correctly enforce the allowlist, preventing messages from unallowlisted OAuth identities from being processed. This fix matters for enterprise Teams deployments where the agent is restricted to specific internal accounts or external partner identities.

Feishu: Allowlist Canonicalization

Feishu sender allowlists are now canonicalized consistently, fixing an edge case where differently-formatted IDs of the same user could bypass or double-trigger the allowlist check. Relevant for teams running Feishu-based outreach into Chinese enterprise accounts.

Discord: Status Command Responses

The !status command in Discord now responds correctly in all gateway configurations. Minor fix, but useful for ops teams monitoring multi-channel deployments from Discord.

TTS Voice Note Reply Persistence

Voice note replies generated by the TTS module now persist correctly after send, closing a gap in conversation history that disrupted follow-up logic in long sequences.

Infrastructure & Memory

Active Memory: Prompt Placement + Logging

The Active Memory plugin's prompt injection point has been corrected — memory context is now placed at the correct position in the prompt template, improving recall accuracy. Logging for memory retrievals has also been improved for observability.

Session Memory: Workspace Scoping + Slug Generation

Session memory is now correctly scoped to the workspace, preventing cross-workspace memory bleed in multi-tenant deployments. Memory slug generation timeouts have also been fixed, eliminating a failure mode where slugs weren't created for long conversation subjects.

Cron Scheduler: Error Backoff + Recovery

The cron scheduler now applies exponential backoff on errors and recovers cleanly from transient failures. Previously, a single scheduling error could stall the entire scheduled-task queue, affecting follow-up sequences timed by cron triggers.

Ollama: Streaming + Usage Reporting

Ollama timeout configuration is now correctly inherited for streaming requests, and usage token counts are now accurately reported in streaming mode. Teams running local Ollama deployments for cost-sensitive or data-residency use cases will see more accurate billing proxies in their dashboards.

Upgrade

# Self-hosted — update OpenClaw
npm install -g openclaw@v2026.4.14

# Or use the B2B SDR Agent Template one-liner (always pulls latest)
curl -fsSL https://raw.githubusercontent.com/iPythoning/b2b-sdr-agent-template/main/install.sh | bash

Cloud-hosted PulseAgent users are already on v2026.4.14 — no action needed.

Comparison: OpenClaw v2026.4.12 vs v2026.4.14

FAQ

Q: Is v2026.4.14 a security-critical update?
A: Yes for any deployment with the web UI exposed to untrusted users (marked.js → markdown-it XSS fix). For CLI-only or API-only deployments, it's a recommended upgrade but not an emergency patch.

Q: Will gpt-5.4-pro work immediately after upgrading?
A: Yes — set models.providers.openai.model: gpt-5.4-pro in your config. Rate limits and pricing are already catalogued in v2026.4.14.

Q: How does topic-name awareness affect my existing Telegram workflows?
A: It's additive — existing flows continue to work. If you want to use topic names in routing logic or persona selection, you can reference {{telegram.topic_name}} in your skill templates after upgrading.

Q: Does this release affect PulseAgent cloud users?
A: Cloud users are already on the latest version. No action required.

Get Started

Deploy a production-ready B2B SDR agent in minutes:

curl -fsSL https://raw.githubusercontent.com/iPythoning/b2b-sdr-agent-template/main/install.sh | bash

Or sign up for PulseAgent — managed OpenClaw hosting with one-click deploy, CRM integrations, and real-time analytics.

→ View pricing · WhatsApp Sales Automation · AI SDR for B2B Export · Telegram Lead Generation · Multi-Channel Pipeline · Manufacturing AI Sales

44 contributors shipped v2026.4.14. Full changelog at github.com/openclaw/openclaw.