OpenClaw v2026.4.20: Security Hardening & Smarter Agents
OpenClaw v2026.4.20 shipped on April 21, 2026 with 60 commits from 59+ contributors. This release is a dual-track upgrade: security hardening that seals several env-injection and config-mutation vectors, and agent quality improvements that make AI SDR pipelines more reliable under real production load. Here's what changed and what it means for B2B export sales automation.
What's New in v2026.4.20
Security Hardening — Env Injection & Config Mutation Sealed
This is the most important upgrade reason for any production deployment.
Workspace .env lockdown extended. Building on the v2026.4.9 runtime-control isolation, v2026.4.20 blocks three additional injection categories from untrusted workspace .env files:
- All
OPENCLAW_*keys (any runtime-control env variable) MINIMAX_API_HOST(model API endpoint override)- Interpreter-startup keys like
NODE_OPTIONSfor stdio MCP servers
If you currently set any of these in workspace .env, move them to system environment (set before daemon start) or to openclaw.json before upgrading.
Config mutation guard extended. A new guard prevents model-driven config.patch and config.apply tool calls from overwriting operator-trusted config paths. This closes a privilege-escalation vector: a compromised or malicious agent can no longer modify gateway security settings, auth policies, or operator-trusted configuration mid-session.
WebSocket broadcasts scoped. Chat, agent, and tool-result WebSocket event frames now require operator.read scope. Unknown event types are scoped by default rather than broadcast. If your integration uses custom WebSocket clients, verify they carry operator.read in their auth token.
Non-admin paired devices restricted. Paired devices without admin rights are now limited to their own pairing actions — they cannot approve or reject other devices. Relevant for multi-operator deployments.
Security fact: The config mutation guard prevents the entire class of "agent-rewriting-its-own-constraints" attacks, a known risk in long-running autonomous agent deployments.
Stronger Default Agent Behavior — Better SDR Pipeline Completion
The biggest quality-of-life upgrade in v2026.4.20 is the strengthened default system prompts.
OpenClaw's built-in prompts now include three new behavioral layers:
Completion bias — the agent is biased toward finishing pipeline steps before stopping. Previously, agents could stall at ambiguous responses (e.g., a lead saying "maybe later") without attempting recovery. Now the agent pushes through to a natural stopping point.
Live-state verification — before marking a pipeline stage complete, the agent verifies it has actually done the work (CRM entry written, quote sent, follow-up scheduled). Reduces silent failures in automated workflows.
Weak-result recovery — when a tool call returns a weak or empty result (web search returns nothing, CRM API times out), the agent automatically retries with a fallback strategy instead of failing the turn silently.
For B2B SDR pipelines, this means measurably fewer stalled conversations, more reliable CRM data capture, and better lead qualification completion rates — without any config changes.
curl -fsSL https://raw.githubusercontent.com/iPythoning/b2b-sdr-agent-template/main/install.sh | bash
Session Resilience — No More Memory Crashes on Long Campaigns
High-volume SDR deployments routinely run hundreds of concurrent conversations over days or weeks. v2026.4.20 addresses two failure modes that affected these deployments:
Session entry cap enforced by default. The built-in session entry cap and age prune are now active by default, and oversized stores are pruned at load time. This prevents out-of-memory conditions on long-running deployments. To customize: set session.maxEntries and session.maxAgeMs in openclaw.json.
Active memory degrades gracefully. If memory recall fails (vector store unavailable, index corrupt, plugin error), the agent now logs a warning and continues the turn instead of failing. Critical for AI SDR for B2B export deployments that process inbound leads around the clock without human supervision.
Memory dreaming stabilized. Memory sweep timestamps are normalized and narrative session keys are deduplicated via hashing, preventing memory leaks across long-running deployments with hundreds of concurrent lead conversations.
Multi-Channel SDR: Auto-Reply Policy & Telegram Fixes
Auto-reply policy scoped per conversation type. The NO_REPLY policy is now applied per conversation type: direct chats receive a helpful rewritten reply while group channels stay quiet. For B2B SDR agents, this means correct behavior out of the box — the agent engages 1:1 leads on WhatsApp and Telegram while staying silent in broadcast or internal staff group chats.
Telegram polling watchdog raised from 90s to 120s. The polling stall threshold increase reduces false-positive reconnects during high-message-volume campaigns. Configurable via channels.telegram.pollingStallThresholdMs if you need tighter or looser detection.
Telegram offset confirmation timeout. A client-side timeout now bounds persisted-offset confirmation, preventing Telegram polling from hanging indefinitely on dropped connections during heavy campaign periods.
Cron & Scheduled Outreach Improvements
jobs-state.json split from jobs.json. Runtime cron execution state is now stored separately from your job definitions. If you version-control your cron config (as recommended for the multi-channel sales pipeline setup), this eliminates noisy state changes in git diffs. Add jobs-state.json to .gitignore if not already present.
Additional cron fixes: explicit delivery.mode: 'none' runs are now treated correctly, isolated-agent delivery chains are preserved, and Telegram dedupe now keys per execution rather than session.
Web Search Plugins — SecretRef Keys Fixed
Plugin-scoped SecretRef API keys for Exa, Firecrawl, Gemini, Kimi, Perplexity, Tavily, and Grok are now correctly resolved. If your lead-discovery or company-research workflow uses any of these search plugins and your keys are stored as SecretRef (the recommended pattern), this fix restores full functionality.
Upgrade Instructions
# 1. Install new version
npm install -g openclaw@latest
# 2. Refresh gateway token (always do this)
openclaw gateway install --force
# 3. Run doctor
openclaw doctor
# 4. Restart
openclaw gateway restart
Before upgrading: if you set OPENCLAW_* keys, MINIMAX_API_HOST, or NODE_OPTIONS in workspace .env, move them to system environment or openclaw.json first.
OpenClaw v2026.4.20 vs. PulseAgent: Which Is Right for You?
| Feature | OpenClaw (self-hosted) | PulseAgent (managed) |
|---|---|---|
| Security updates | Manual upgrades required | Applied automatically |
| Default system prompts | v2026.4.20 strengthened | Pre-configured + optimized |
| Session memory management | Configure maxEntries / maxAgeMs |
Auto-managed |
| WhatsApp + Telegram | ✅ | ✅ |
| Cron outreach campaigns | Self-managed | Built-in scheduler |
| Setup time | 15–30 min + ongoing ops | < 5 min |
| AI SDR for manufacturing | Template-based | Ready to deploy |
PulseAgent runs fully managed OpenClaw with all v2026.4.20 hardening applied automatically. Start free →
Frequently Asked Questions
Q: Do I need to change my openclaw.json after upgrading?
Only if you set OPENCLAW_* keys, MINIMAX_API_HOST, or NODE_OPTIONS in workspace .env. Everything else upgrades transparently.
Q: Will the session entry cap prune my existing conversations?
Oversized stores are pruned at load time. If you have large session stores and don't want pruning, set session.maxEntries explicitly to a higher value in openclaw.json before upgrading.
Q: My web search plugin keys were working before — will they still work after upgrading? Yes — the SecretRef resolution fix restores correct behavior. No action needed.
Q: How do the stronger default prompts affect my custom IDENTITY.md and SOUL.md?
The new defaults add completion bias, live-state verification, and weak-result recovery at the system level. They complement custom instructions — they don't override them. Your custom persona and sales workflow are preserved.
Q: What's the Telegram polling watchdog change for? High-volume campaigns (500+ messages/day on a single Telegram channel) occasionally caused the 90-second watchdog to fire on legitimate slow patches, triggering unnecessary reconnects. 120 seconds eliminates most false positives without meaningfully delaying real stall detection.
Q: Can PulseAgent handle the full 10-stage SDR pipeline out of the box? Yes. See pricing →
Deploy Your AI SDR Today
OpenClaw v2026.4.20 is the most security-hardened release of the year so far — and the agent quality improvements make it the best version to run a production B2B sales pipeline on. Deploy the full template:
curl -fsSL https://raw.githubusercontent.com/iPythoning/b2b-sdr-agent-template/main/install.sh | bash
Or run fully managed on PulseAgent — no infra, no upgrade maintenance: Start free →
Explore solution guides: