OpenClaw v2026.10.2 fixes a credential redaction leak and the upgrade from 2026.10.1

OpenClaw published v2026.10.2 on 12 October 2026, two days after 2026.10.1, and it mattered for two reasons. It masks credentials that cross a chunk boundary in long tool output, a redaction gap that could put secrets into text you thought was scrubbed. And it repairs the first upgrade from stable 2026.10.1. Stable has moved on since: the releases page marks openclaw 2026.10.7, released 24 October 2026, as Latest. So the reason this release matters is unchanged, but the action is not to install 2026.10.2 specifically. If you are still on 2026.10.1 or earlier you are missing the redaction fix, and openclaw update takes you to the current target for your channel.

#What does the secret redaction fix actually fix?

OpenClaw redacts credentials out of tool output before that output is stored or sent onward. The release notes say the fix means "credentials that cross a chunk boundary in long tool output are now masked", and the fixes list records that it "Fixed credential leaks across redaction chunk boundaries and redaction stalls on large tool output."

Read together, those describe a boundary bug rather than a missing feature. Redaction worked on the text it was handed, and long tool output is handed over in pieces. A secret that happened to straddle the seam between two pieces matched neither piece on its own, so it passed through unmasked. The same release also makes large-text redaction faster and stops it stalling.

What OpenClaw has not published is any claim about impact. There is no incident report, no CVE, and no statement that any user's credentials were actually exposed. This article does not make that claim either. What the vendor's own notes support is narrower and still worth acting on: until this release, OpenClaw's redaction had a gap that long tool output could fall through, and the project has now closed it. If your agent runs commands that print credentials, and especially if their output is logged, forwarded to a channel or fed to a model provider, that is a reason to upgrade this week rather than next.

#Why does the upgrade path itself need a fix?

Because the previous stable release had trouble installing the next one. The 2026.10.2 highlights say "the first upgrade from stable 2026.10.1 now completes cleanly", and the notes describe Windows and other update paths no longer stalling or rolling back.

That ordering is the awkward part: the fix for upgrading from 2026.10.1 ships in the release you reach by upgrading from 2026.10.1. If your update stalled or rolled itself back, the documented recovery is a repair run rather than a retry:

openclaw update repair

If you want to see what an update will do before it does it, the flag is documented for exactly that:

openclaw update --dry-run

And to check whether an update is waiting:

openclaw update status

The docs list the channel under the JSON form, so run openclaw update status --json when the channel is the thing you need.

Doctor got attention in the same release. The notes say "Doctor no longer stops on residual legacy imports, stale Gateway locks, slow state inspection", which matters here because Doctor is the tool most people reach for when an update leaves the Gateway in a strange state. A Doctor run that halts partway is no help diagnosing a half-finished upgrade.

#Which version should you be running?

Three releases landed inside three days in October 2026, and their numbers did not sort the way their dates did. Stable has moved several releases past all three since, so read the table below as the state on 12 October 2026 rather than as current advice.

The trap that week was v2026.10.5-beta.1. It carried the highest version number of the three and was published before v2026.10.2, so a quick look at the releases page could read as though stable had fallen behind. It had not. The beta line is numbered ahead of stable, and 2026.10.5-beta.1 is a pre-release. That reading trap is the durable lesson here, and the numbers have moved on since. As of 26 October 2026 the releases page marks openclaw 2026.10.7, released 24 October 2026, as Latest, with stable 2026.10.3, 2026.10.4, 2026.10.5 and 2026.10.6 between it and this release, so a reader still on 2026.10.2 is four stable releases behind. If you are on the stable channel, 2026.10.7 is where you should be, and openclaw update targets your channel rather than the newest tag on the page.

Switching channels is a documented flag, not something to do by accident:

openclaw update --channel beta

Our migration guide covers version moves that change configuration, and troubleshooting covers a Gateway that does not come back up.

#What else changed that could alter behaviour without you asking?

Two items in the release are defaults rather than fixes, which makes them the ones to read before you upgrade a setup you depend on.

The first is compaction. The Changes section states: "Defaulted OpenAI and Anthropic API-key routes to provider-native compaction." If you run OpenClaw against OpenAI or Anthropic with your own API key, how long conversations get compacted changes on this release, with no action on your part.

The second is prompt caching. The highlights say "Anthropic conversation checkpoints, enriched user prompts, tool results, and inter-session provenance stay byte-identical" across follow-ups and restarts, so cached prefixes keep hitting. For anyone paying per token against Anthropic, a cache that stops hitting is a cost change, and this release is aimed at keeping it hitting.

The remaining two Changes entries are about release mechanics rather than runtime: "Reported finalized update successes and suppressed channels as warnings instead of failures", and "Stopped live npm dist-tag drift from failing already-validated release candidates."

The Fixes section runs to roughly a dozen more entries, covering messaging delivery, Claude CLI session display, subagents, tool loops, OpenAI and Codex turns, cron runs, the Control UI and macOS crashes. The size of the release is a better measure of it than its highlights are, and OpenClaw's own two records of this version do not agree on that size. The GitHub release entry's contribution record reads "85 in-range PRs + 0 retained seed-only PRs = 85 unique PRs", while the docs release notes page for the same version says "Release scale: 80 pull requests, 12 direct commits, and 107 contributors." This article follows the GitHub release entry, because that is where the release notes it quotes are published, and we have found nothing that reconciles the two counts.

#What should you do this week?

Check where you are, preview the update, then take it. For a setup that matters, in that order:

openclaw update status
openclaw update --dry-run
openclaw update

If the update stalls or rolls back, run openclaw update repair rather than retrying the same command. On the stable channel that sequence now lands you on 2026.10.7 rather than on 2026.10.2, and it carries the redaction fix this article is about forward with it. If you deliberately run the beta channel, note that 2026.10.5-beta.1 is a pre-release and was published before 2026.10.2.

The one thing not to defer is the redaction fix. Everything else in this release is reliability work that will still be there next month. A credential that was not masked was not masked at the time it was written down, and upgrading does not go back and unwrite it. If your agent's tool output goes anywhere you would not paste a secret, it is worth upgrading now and reviewing where that output has been going.

For the platform's current verified facts, the OpenClaw hub is where we keep them, and security hardening covers the wider question of what an OpenClaw install can reach.

#What we could not confirm

The release page shows a publication time of 05:34 with no year and no time zone, which is why this article states the date and not the hour.

OpenClaw publishes two records of this release and they disagree on its size, as the section above sets out: 85 pull requests on the GitHub release entry against 80 on the docs release notes page. We have found nothing that reconciles them.

We did not install this release. Nothing in this article reports behaviour we observed on a machine: the quoted lines come from the release notes, and the commands come from OpenClaw's update documentation.