This week’s OpenClaw Weekly arrives with urgent news on two fronts: a landmark performance release that rewrites what the platform is capable of, and a critical security advisory that every production deployment needs to address before the weekend. On top of that, a fork just raised $12M, an enterprise governance platform launched, and a major academic conference focused on agentic systems kicks off tomorrow. It was not a quiet week in the OpenClaw ecosystem.

โš ๏ธ Security First: The Claw Chain Attack

Published today by IANS Research, the “Claw Chain” advisory describes a chained vulnerability attack that converts OpenClaw’s partial sandbox into a launchpad for full host compromise.

The chain links four CVEs:

  • CVE-2026-44115 โ€” Logic flaw exposing stored API keys and provider credentials
  • CVE-2026-44118 โ€” Privilege escalation to host-level permissions
  • CVE-2026-43527 and CVE-2026-43582 โ€” Critical flaws identified by the Financial Security Authority in a parallel advisory published yesterday

OpenClaw’s docs are honest about the sandbox: “not a perfect security boundary.” The Claw Chain attack exploits that honesty. With API key stores in scope, a successful exploit can drain cloud provider budgets โ€” not just compromise a machine. Earlier this week an arXiv paper (2605.23330v1) provided the first systematic academic analysis of OpenClaw’s security surface, framing the blast radius of a gateway compromise as categorically larger than a chatbot breach: the gateway holds credentials, messaging accounts, filesystems, and session history simultaneously.

Immediate actions for affected deployments:

  • Update to v2026.5.22+
  • Rotate all API keys stored in the gateway
  • Enable tools.exec.host=sandbox if not already set
  • Audit installed skills against the ClawHavoc known-bad list (see below)

A CVE-2026-4039 (Skill Env Handler, applySkillConfigenvOverrides) was also documented by Endor Labs, affecting OpenClaw 2026.2.19-2. Teams on pre-2026.2.12 releases are exposed to 40+ unpatched vulnerabilities.

v2026.5.22: The Performance Release the Community Has Waited For

Released May 24, the latest stable version delivers the most significant gateway performance improvement in project history. The headline number โ€” 4,100ร— โ€” applies specifically to the /models endpoint, which had been taking up to 30 seconds under normal load. The root cause: repeated bundled-channel boundary checks on every call. The fix reuses process-stable channel catalog reads and rotates gateway watch CPU cycles. Under typical configurations the endpoint now responds in under 10ms.

This matters practically, not just on benchmarks. Every skill invocation, every new session, and every model-routing decision touches the model catalog. A 30-second wait was invisible in demos and catastrophic in production pipelines with any call density.

Beyond the performance work, v2026.5.22 ships:

  • Meeting Notes plugin โ€” Discord voice channels become a first-class data source. The plugin transcribes voice meetings and surfaces structured summaries automatically to the agent, without manual transcript uploads.
  • Grok web search โ€” xAI’s search is now a supported web provider alongside Perplexity and Brave.
  • Smarter sub-agent context โ€” spawned sub-agents receive targeted context slices rather than full session dumps, meaningfully reducing token spend on long-horizon tasks.
  • 100+ bug fixes across gateway, channel adapters, and skill execution.

The preceding v2026.5.20 is also worth noting: it tightened untrusted skill execution defaults (sandbox mode on by default for new installs, tools.exec.ask enabled), added Discord voice channel auto-follow, and shipped xAI OAuth device-code auth to eliminate manual API key management for Grok users.

SKILL.md Breaking Change: Migrate Your Sources

A structural change buried in the release train deserves more attention than it’s getting. Paired-source declarations have moved from openclaw.plugin.json to each SKILL.md’s frontmatter as a sources: array, validated by loadSkillSources in bundle.ts (D2 schema). Skills that haven’t migrated will fail to load after the next major version. If your team runs custom skills or has pinned community skills, test against v2026.5.22 now before the migration deadline forces a scramble.

EnterpriseClaw and the Governance Gap

Automation Anywhere launched EnterpriseClaw on May 19, framing it explicitly as a governance layer for organizations that want claw-style agents without the open skill model liability. The platform adds centralized policy enforcement, audit trails, and role-based access controls that vanilla OpenClaw doesn’t provide.

The timing with the Claw Chain advisory is not coincidental. The structural problem with OpenClaw in regulated environments isn’t any single CVE โ€” it’s the architecture: skills run arbitrary code, the sandbox is partial, and there’s no native mechanism for centralized policy. EnterpriseClaw and forks like TrustClaw exist because patching individual CVEs doesn’t close that architectural gap.

ClawHavoc: 1,200+ Malicious Skills Still in the Marketplace

Academic research (OpenReview.net) documents the ClawHavoc campaign, a coordinated supply chain attack that may have introduced over 1,200 malicious skills into the ClawHub registry. The scope is still being assessed. With the registry now at 13,729+ skills, the signal-to-noise ratio in unvetted installs is a genuine enterprise risk.

Community mitigations are emerging: clawsec (prompt-security) provides a security skill suite with prompt injection detection and integrity monitoring. Tencent’s EdgeOne Skill Scanner offers local static analysis of skill files before installation. Neither replaces a formal skill vetting policy, but both reduce surface area for teams that can’t wait for platform-level fixes.

NanoClaw Raises $12M, Turns Down $20M Acquisition

NanoClaw’s creator turned down a $20M buyout offer and raised a $12M seed round instead, now booking enterprise customers. This is the first significant venture capital bet on the OpenClaw fork ecosystem โ€” a signal that investors see differentiated value in performance-optimized variants beyond what the core project delivers. Competing forks (ZeroClaw, PicoClaw, ZeptoClaw, TrustClaw) are also gaining traction, and ClawTrackr.com now tracks the landscape with regular comparison analysis.

The fragmentation parallels early browser-era dynamics: one dominant platform, multiple specialized forks chasing specific use-case or compliance niches. The key risk for enterprise teams is skill compatibility โ€” skills written for core OpenClaw may not run on fork runtimes without modification.

Ecosystem Velocity

The community data points to a platform still accelerating. 374,681 GitHub stars puts OpenClaw at #6 on the all-time GitHub ranking. OpenClaw creator Peter Steinberger publicly disclosed $1.3M in OpenAI API token usage over 30 days โ€” an inadvertent but compelling proof of production scale.

The ACM Conference on AI and Agentic Systems (CAIS 2026) opens tomorrow in San Jose (May 27-29). It’s the first academic conference dedicated to agentic systems, co-chaired by Two Sigma’s Heather Miller. Expect research outputs from the conference to shape OpenClaw’s security and governance roadmap over the next cycle.

Deployment infrastructure also matured this week: the DigitalOcean Marketplace now lists a one-click OpenClaw Droplet, and the openclaw-rocks/openclaw-operator Kubernetes operator brings production-grade lifecycle management for teams running OpenClaw at scale.

What to Watch

  • Emergency patch for Claw Chain: Expect a v2026.5.23 or hotfix release from the OpenClaw team in response to this week’s CVE cluster. Watch the GitHub releases feed.
  • ClawHavoc marketplace response: The 1,200-skill campaign will likely force a formal marketplace vetting policy announcement. Watch for changes to ClawHub submission requirements.
  • ACM CAIS 2026 outputs: Research from this week’s conference (May 27-29) will likely produce foundational papers on agentic security frameworks โ€” with direct implications for OpenClaw governance.
  • NanoClaw enterprise roadmap: First funded fork with active enterprise bookings. API compatibility commitments vs. core OpenClaw will determine whether its skills ecosystem fragments or stays compatible.

Work With Big Hat Group

If your team is navigating this week’s security disclosures, evaluating EnterpriseClaw vs. a hardened core OpenClaw deployment, or building custom skills that need to survive the SKILL.md migration โ€” we can help. Big Hat Group delivers production-grade OpenClaw enterprise deployments with Entra ID identity, signed skills, audit logging, and network segmentation baked in. Book a discovery call or explore our AI automation services.

Check back next week for another OpenClaw ecosystem roundup.