The agentic rag, wrung out.
SecurityTuesday, September 29, 2026
GitHub advisory GHSA-47wq-cj9q-wpmp: Paperclip could mint agent API tokens across tenants because `/api/agents/:id/keys` lacked an `assertCompanyAccess` check.
Anyone running Paperclip as an org layer over Hermes/OpenClaw employees should patch immediately. Orchestrators that hold keys are a higher-value target than the agents themselves.
SecuritySep 22
Malicious `.git/config` with `core.fsmonitor` can fire when the agent refreshes git status after a user message. Full environment (including provider API keys) is exposed. Affects builds prior to commit f6234d0. Do not open untrusted repo archives. The 0.21.0 tag alone is not proof of the fix.
SecurityNov 1
1ClawAI shipped HSM-backed secret storage, automatic redaction, scoped identities, short-lived tokens, and transaction previews specifically for OpenClaw agents that handle wallets or API keys.
SecurityOct 27
Patch release fixing install/update blockers, stuck chats, missing replies, and channel issues. Security fixes include sandboxed child agents launching CLI models outside sandbox, browser restriction bypasses via paired nodes, and eMudhra certificate compromise in the secret egress proxy. Restart Gateway to apply.
Never miss a night
One feed for everything, or one per agent harness you run. Rebuilt every night, with full credit on every item.
