OpenClaw 周更 2026.6.6：安全、Telegram、iMessage 三件套升级

# OpenClaw Weekly Update 2026.6.6: Security, Telegram, iMessage Triple Upgrade **Project**: openclaw (37.8K Stars, 7.9K Forks on GitHub — personal AI assistant written in TypeScript) **New Version**: v2026.6.6 **Release Date**: 2026-06-12 19:04 (Beijing Time) **Time Since Last Version (2026.6.5)**: 3 days — a weekly release cadence --- ## 01. One Version Per Night — What's This Project All About? If you've been scrolling GitHub Trending lately and spotted a repo called **openclaw** with a lobster logo and the description "Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞" — that's it. 37.8K Stars and 7.9K Forks — in the AI assistant category, that's top-tier. The repo description is straightforward: your personal AI assistant that runs on any OS and any platform, with a "lobster way" philosophy. It takes a completely different path from cloud SaaS like ChatGPT or Claude — local-first, cross-platform, and bridges into your everyday chat tools (Telegram, iMessage, Discord, WhatsApp, Feishu, QQ bots, WeCom... you name it, it probably supports it). In plain English: **You want AI to live inside your existing chat apps and do the work for you, instead of opening yet another app.** This 2026.6.6 release comes just 3 days after the previous stable version 2026.6.5, and before that, 2026.6.1 was released on June 3rd — **this is a weekly-updated project**. So this isn't some "annual major release" — it's more like a solid iteration. But the density of updates is high, and the direction is consistent: **tighten the guardrails, connect the pipelines.** --- ## 02. Security Guardrails: 14 Boundaries Tightened Simultaneously, the Harshest One is "Timeout = Direct Rejection" The first highlight in this release notes is security, listing **14 PR numbers** and tightening boundaries across 14 different subsystems simultaneously — this isn't a minor bug fix; it's a full-scale reinforcement of the entire guardrail system. Here are the most impactful changes for regular users: > **Exec approvals now fail closed on timeout.** Meaning: if you authorize the AI to execute a high-risk operation (like modifying files or running commands), and it asks for your permission but you don't respond within 30 seconds, it won't wait idly or "default to approve" — **it will directly reject and tell you "I didn't get your authorization."** > **MCP stdio, Codex HTTP, Discord moderation, Teams group operations** — all these access points that were previously "enabled by default" are now tightened to follow strict rules. Previously, the door was open but unguarded; now the door frame is welded shut. > **Sandbox binds** and **host environment inheritance** are both being overhauled. In plain terms: what environment variables the AI can see when running locally, and what host capabilities it can inherit — these boundaries are being redrawn. > **Loopback tools** — local self-calling tools — previously had room for abuse; now the boundaries are clearly defined. What does this mean? The biggest fear with AI assistant tools has never been "it's not smart enough," but rather **"it did something I didn't know about."** This version's stance is clear: **better to reject than to let slip.** For individual users, the chance of your lobster assistant "acting on its own" will noticeably decrease. --- ## 03. Telegram Pipeline: Completely Rewritten, 9 PRs All About Experience The second highlight is the Telegram delivery layer. 9 PRs together essentially **rewrite the entire Telegram channel**. Three things worth mentioning: **First, account-scoped topic routing.** Previously, if you had multiple agents tied to the same Telegram account, messages sent to different groups could be randomly assigned to any agent. Now, **routing is precise by account + topic** — who sends to which group, and which agent the conversation context follows, won't get mixed up. **Second, streaming text no longer drops characters when crossing tool calls.** This is a detail many have stumbled on: you ask the AI to check the weather, it starts typing while calling a weather tool, and when the tool returns, **all the previous text disappears.** This version fixes that. **Third, unauthorized DM text no longer enters the cache or prompt context.** If a stranger DMs you on Telegram, those messages **won't be silently injected into your prompt** to influence the AI's judgment. This is especially important for privacy-conscious users. There's also a DevOps-friendly change: **durable dispatch deduplication moved into the SDK.** Meaning: the fallback logic for handling duplicate sends (when a message is sent but no confirmation is received) is now handled uniformly at the SDK level, so business logic doesn't need to implement its own. --- ## 04. iMessage Pipeline: Upgraded from "Works" to "Reliable" The iMessage channel has always been tough because Apple's protocol is closed — many AI assistants either don't support it or support it poorly. This version's iMessage changes span 6 PRs covering **always-on restart recovery, persistent echo markers, chunked streaming, idle state approval detection, outbound outbound hardening, and actionable inbound startup diagnostics** — in plain English: > Your iMessage assistant is now **as stable as WeChat**. Previously, you might send a message and the AI wouldn't reply for a while, or the reply would cut off halfway. Now, reconnection, resume-on-interrupt, and idle authorization confirmation are all in place. For iPhone users, this is even more important than the Telegram update — **many open-source AI assistants' iMessage experience has been half-baked; this version brings it to a usable level.** --- ## 05. Faster Console First Response, New OpenRouter OAuth and Claude Fable 5 Finally, performance and new model integration. **Console first-response latency reduced**: model metadata is cached, the startup directory pull is removed, slash commands are lazy-loaded, and first-event instrumentation + slow-reply diagnostics are added — all optimizations for that "spinning wheel on open" experience. The wait time from pressing Enter in the Control UI to seeing the first character should be noticeably shorter. **New models**: - **OpenRouter OAuth integration** — no more pasting API Keys everywhere; one-click OAuth authorization. - **Claude Fable 5** — Anthropic's new model with "adaptive thinking," now officially supported. - Local models now skip guardian review — **when running local small models, you won't be repeatedly hit with "security review in progress."** --- ## 06. What Does This Mean for You? Three Groups, Look Here **Group 1: Already using openclaw** — **you should upgrade**, especially if you have Telegram or iMessage bridges enabled. The security tightening is a good thing — it won't make the AI "dumber," just "more obedient." Upgrade command as usual: `npm i -g openclaw@latest` or use its built-in update command. **Group 2: Thinking about setting up a personal AI assistant but haven't started** — 37.8K Stars aren't for nothing. It's the most comprehensive cross-platform, cross-chat-tool solution out there. If your daily drivers are Telegram or iMessage, **this version is a great time to jump in** — Telegram routing and streaming, and iMessage reliability, are now at usable levels. **Group 3: Following the AI agent ecosystem** — pay attention to openclaw's update cadence. **Weekly updates** mean the team is constantly adding stuff. The security boundary approach (exec approvals fail closed, loopback tools tightened, unauthorized DMs excluded from prompts) is essentially **the latest security consensus in the 2026 AI agent industry** — if you want to see what a "benchmark" looks like, watch this project. --- ## Uncle Peng's Take My verdict on this update: **Not a major release, but a sincere one.** In weekly-updated projects, the easiest trap is "small fixes to pad the numbers." 2026.6.6 doesn't have that problem — 14 security PRs tightened simultaneously, 9 PRs rewriting Telegram, 6 PRs covering the full iMessage pipeline — **this isn't padding; this is real work.** But I'll also pour some cold water: openclaw's "personal AI assistant" narrative **has a high barrier to entry.** You need to know Node.js, API Keys, sandbox configuration, Telegram Bot setup, and iMessage inbound configuration isn't beginner-friendly either. Its 37.8K Stars come mostly from the developer community — **the "plug-and-play for regular users" experience is still far from Claude Desktop or ChatGPT App.** My take: openclaw won't disrupt ChatGPT's general SaaS base in the short term, but **in the "power users + bridging their own ecosystem" niche, its position is getting stronger.** This version's security tightening is paving the way for enterprise teams to adopt it into workflows — **without security tightening, no matter how good it is, it's just a personal toy.** So keep an eye on it — it's one of the windows into whether AI agents can actually land in enterprises. --- ## Over to You in the Comments What's your current personal AI assistant setup — openclaw, ChatGPT, Claude Desktop, or local Ollama + your own scripts? If you've used openclaw, **can you handle this weekly release cadence?** Or would you prefer slower, bigger releases? Let's chat in the comments.