The agentic rag, wrung out.
The rag for
OpenClaw v2026.10.1 release combined with the concurrent rise of agent sandboxing and config-level security issues
The official OpenClaw drop (skill discovery, MCP Apps beside chat, robust backups, massive contributor volume) shows the core runtime continuing to mature at high speed. At the same time, a Hermes config-injection path to approval bypass, MCP-related CVEs, Ollama issues, and the simultaneous appearance of production sandbox tools (Microsoft MXC, community CubeSandbox) highlight that execution boundaries are becoming a first-class problem. The China grassroots adoption stories add distribution color. Together they form the clearest narrative of the day: capability is shipping fast, and the community is now forced to confront how agents actually execute and persist.
Microsoft shipped Execution Containers (MXC) 1.0.0 GA (open source) with process/session/WSL/MicroVM options and macOS process container support. Concurrent community discussion of CubeSandbox-style isolated execution for OpenClaw + DeepSeek Harness (134 ms spin-up, control/execution plane split). Multiple other sandboxing signals in the same week.
VulnCheck published a CVE on a third-party dashboard (9router) that allows authenticated users to inject arbitrary keys into Hermes config.yaml via a settings endpoint. Demonstrated path: set hooks_auto_accept and a shell command that then runs after LLM calls with no further approval. The underlying condition is “write access to Hermes config = ability to disable approval gates.”
Major update to the popular power plugin. SkillEx adds quoting safety, plan-level untested flags, debugging stop-after-three, explicit finish lines, and review caps. FenceGuard keeps parallel coding agents inside sandboxes with no credentials/network by default and prevents settings injection. Memory improvements and multi-terminal efficiency.
Desktop can now search the Plugin Catalog and Skills Hub from inside an ongoing conversation, surface options, and present an install card for approval. Installation lands in the current profile. No terminal required mid-task.
Continued reporting of large-scale grassroots adoption. Installation services priced around 3,400 CNY with thousands of orders; uninstall services now also commercialized at higher rates. Anecdotes of elderly users asking family to “install the lobster,” queues at Tencent Shenzhen, and Xiaomi phone integration mentions.
Official release adds installed-skill search so agents find relevant skills without loading the entire library into context. MCP Apps now sit beside chat for interactive work with forms, files, and selected content attachment. Full backups to external disks, NAS, or Cloudflare R2 with staging restore. Simpler Mac install. 2,425 PRs from 402 contributors.
Never miss a night
One feed for everything, or one per agent harness you run. Rebuilt every night, with full credit on every item.
