OpenClaw v2026.2.24: “Stop” Means Stop

OpenClaw v2026.2.24 is a release about control surfaces and trust boundaries. It reads like the project reacting to its own speed: make “stop” unambiguous, make onboarding less fragile, and make proactive automation (heartbeat/cron) harder to misroute into private spaces.

This isn’t a flashy platform expansion like the Watch drop — it’s the less glamorous work that keeps an agent system from turning into a chaos generator.

Abort Shortcuts: One Word, No Negotiation

The headline change is deceptively small: OpenClaw’s “stop” triggers got upgraded from a handful of phrases into a strict, standalone, multilingual abort vocabulary — including punctuation-tolerant forms like STOP OPENCLAW!!!, plus explicit phrases such as do not do that acting as a stop trigger (still requiring strict standalone matching). oai_citation:1‡GitHub

This matters because “stop” is not UX sugar in agent land — it’s your emergency brake. If your assistant can browse, execute, message, and automate, then abort has to be fast, reliable, and culturally robust, not “works on my English prompt.”

Android UX: Onboarding as a First-Class Feature

Android gets a substantial restructuring: a native four-step onboarding, followed by a five-tab shell (Connect, Chat, Voice, Screen, Settings), plus a full Connect setup/manual-mode screen and refreshed chat/settings surfaces built around the new navigation model. oai_citation:2‡GitHub

Translation: less “DIY wiring” at first run, more “this is a product.” Onboarding is where most self-hosted assistants lose people — not at the model layer, but at the “how do I connect anything without breaking it” layer.

Talk Config Goes Provider-Agnostic

v2026.2.24 adds provider-agnostic Talk configuration (with legacy compatibility) and exposes gateway metadata for ElevenLabs Talk setup/status surfaces. oai_citation:3‡GitHub

That’s a subtle but important direction: Talk becomes a capability with a stable interface, not a provider-shaped config tangle.

Trust Model Hardening: Multi-User Heuristic

OpenClaw now ships a security.trust_model.multi_user_heuristic audit signal to flag likely shared-user ingress, with explicit guidance for intentional multi-user setups (sandbox mode, workspace-scoped file systems, reduced tool surface, and “don’t mix personal/private identities on shared runtimes”). oai_citation:4‡GitHub

This is OpenClaw acknowledging what fast-growing agent projects eventually have to say out loud:

Most configurations are “personal assistant.” If you’re running “shared assistant,” you’re in a different threat model.

Breaking Changes: Heartbeats Can’t DM People Anymore

Two breaking changes define the boundary work in this release:

  1. Heartbeat delivery now blocks direct/DM targets (Telegram user chats, WhatsApp direct JIDs, user:<id>, etc.). Heartbeat runs still execute — they just can’t spray into private chats. oai_citation:5‡GitHub

  2. Sandbox Docker namespace-join mode is blocked by default (network: "container:<id>"), with a break-glass flag if you truly intend it: agents.defaults.sandbox.docker.dangerouslyAllowContainerNamespaceJoin: true. oai_citation:6‡GitHub

Both changes have the same shape: stop the system from “accidentally powerful” behavior unless you explicitly opt in.

Fixes: Routing, Typing Loops, Voice Stability, and “Reasoning” Leakage

The fixes list is long, but it clusters into a few themes:

  • Cross-channel routing & session isolation got hardened to avoid the wrong UI/channel hijacking replies in shared sessions, and to fail closed rather than fall back to stale routes. oai_citation:7‡GitHub
  • Heartbeat/cron behavior now defaults to less external output (implicit delivery target flips from last to none), drops stale queued heartbeats, and prevents leakage into threads/topics. oai_citation:8‡GitHub
  • Typing indicators now refresh on keepalive during long replies and clean up timers properly — the kind of fix you only notice when it’s missing. oai_citation:9‡GitHub
  • Discord voice reliability gets a real maintenance pass (DAVE dependency restored, join options, rejoin recovery after repeated decrypt failures). oai_citation:10‡GitHub
  • “Reasoning” suppression is enforced for WhatsApp and iMessage paths to prevent hidden thinking blocks from leaking into user-visible messages. oai_citation:11‡GitHub

Put bluntly: v2026.2.24 reduces the ways an agent can embarrass you in public or leak internals into the wrong place.

The Signal

If v2026.2.19 was “new surfaces” (Watch + APNs wake), v2026.2.24 is “governance of the surfaces” — the stop word, the onboarding, the routing boundaries, and the automation defaults.

That’s a very good sign for a project moving from “fast” to “durable.”

Full release notes on GitHub. oai_citation:12‡GitHub