Swarm is on by default, every agent can now read every other agent's sessions, and GPT-6 Astra landed. Here's what changed for people who actually run this thing, ranked by how much it can hurt you.
The tag landed on September 5 at 20:00 UTC, signed by Peter Steinberger, with 1,247 pull requests in range. I read the whole changelog so you don't have to, and I want to start with the line that isn't in the Highlights section.
Buried in Changes: "session tools now default to all-session visibility and ordinary agent-to-agent access is enabled." If you run more than one agent on a Gateway, every one of them can now read the others' sessions unless you set tools.sessions.visibility to agent or self. That's a permissions change shipped as a feature. It's not wrong, but it's the kind of thing you want to know before your Reddit-scraping agent can read your banking agent's transcript.
Everything else below is ordered by blast radius, not by how the release notes present it.
The defaults that moved
Cross-agent session access is open by default. Covered above. Set tools.sessions.visibility to self on any agent that handles credentials, money, or private messages. Existing tool and sandbox restrictions still apply, but visibility is now opt-out. If you're running a multi-agent setup, this is the first thing to do after upgrading, and the OpenClaw multi-agent setup guide covers why memory and session isolation matters in the first place.
Swarm is enabled by default. Concurrent sub-agents with structured results and live progress, no flag required. Explicit opt-outs, tool restrictions, and the separate Code Mode opt-in are preserved. The practical effect: tasks that used to run serially can now fan out, which is faster and also means a single bad instruction can be obeyed by several workers at once. If you haven't written per-agent role files yet, the AGENTS.md for multi-agent systems post is the companion to this release.
Two defaults flipped in one release: agents can see each other, and agents can spawn each other. Neither is a bug. Both deserve a deliberate yes rather than an accidental one.
GPT-6 Astra is in, with real plumbing
You can now select openai/gpt-6-astra with an OpenAI API-key profile or an eligible ChatGPT/Codex account. Text and image input, Responses tool calls, and the supported reasoning controls all work. Subscription availability follows account discovery, so if your ChatGPT plan doesn't show Astra yet, OpenClaw won't either.
The deeper changes are for API-key users on the official Responses endpoint: direct function tools run asynchronously, active responses can be steered over cached WebSockets, and request prefixes are retained when you change reasoning effort. There's also a /think ultra orchestration mode for both the OpenClaw and native Codex runtimes.
Before you flip your default model, read the numbers. We ran Astra against Fable 5.1 and Sonnet 5 on real agent tasks and it came out the most expensive per task by a wide margin, largely because reasoning tokens bill as output at $50 per million. The full breakdown is in GPT-6 Astra vs Fable 5.1 vs Sonnet 5 on real agent work. Short version: it earns a routing slot for computer use, not for your morning briefing.
The reliability fixes that were overdue
This is the part of the release that will quietly save people the most grief.
Upgrades keep your settings now. Automatic updates retain active settings, enabled skills, and default-agent ownership. Gateway restarts after Git updates are restored. Chat-triggered updates report success, failure, or an intentional skip with recovery guidance instead of silence. If you've ever updated and found your default agent reassigned, that's the bug they closed.
Replies survive restarts. Active, queued, and delegated replies recover after a Gateway restart, and one completed reply can no longer discard another's recovery marker. Continuation instructions persist through compaction and retries.
Backups stopped lying. Git backups preserve text containing embedded NUL characters, Nix-managed config and credential links are supported, and corrupt archive headers are rejected instead of accepted as a partial backup. Skill Workshop backups refuse incomplete directory snapshots. A backup that silently drops data is worse than no backup, so this one matters.
Settings change without a restart. More agent, model, tool, channel, browser, node, access, and terminal settings apply live through their running owners. The ones that still need a restart are marked in the configuration reference.
There's also a new Gateway latency diagnostic that splits RPC time into phases in OpenTelemetry and Prometheus, so "it's slow" becomes "dispatch is slow" or "execution is slow." If you've been chasing latency, that's the tool you wanted.
Channel by channel
If your agent lives in a chat app, here's your slice.
- Slack gets a native Stop button, session processing and approval status, and synchronized session titles. Delivery no longer duplicates replies after a lost streaming acknowledgment, and explicit rate-limit rejections are retried. Agents are now guided to use supported Block Kit layouts for proactive replies.
- WhatsApp finally delivers the reason a turn failed, timed out, or was refused instead of leaving the conversation silent. If you've stared at a WhatsApp thread wondering whether the agent died, this is your fix.
- Telegram restores media through explicitly configured SOCKS and HTTPS proxies, including where local DNS can't resolve the destination, and preserves headings, code, quotes, and tables inside details containers in rich mode.
- Discord retains action-message bodies and inline code across chunks, keeps voice playback moving through pauses, and adds an opt-in listen-only meeting capture with automatic notes and a Control UI Meetings page.
- Mattermost recognises mention-prefixed commands like
@bot /newand recovers reactions and button actions after transient lookup failures.
Channel reloads are also bound to the correct Gateway after plugin reloads now, which closes a class of "I reloaded a plugin and my channel went to a different Gateway" reports.
Smaller things worth knowing
Plugin icons move to a packaged assets/icon.png instead of a manifest URL, loaded without a network request. An experimental plugin UI (Settings, then Labs, then Custom plugin UI) lets plugins contribute Control UI pages and panels. Personal connected accounts let you pick a provider account per chat. Single-user Gateways get a durable Owner profile without extra permissions. Cron jobs preserve the final reply when an automation removes itself, and failure-alert policies survive editing and cloning.
And one deprecation with a date: untrusted-named prompt-context aliases in the Plugin SDK become eligible for removal on or after September 8, 2026. That date has now passed. If you maintain a plugin, migrate to the channel-named context fields and buildChannelMetadata.
Should you upgrade?
Yes, and not only for the features. The Doctor upgrade path was itself fixed in this release (it now retains active settings and the original default agent when migrating a legacy multi-agent roster), which means 2026.9.2 is a safer upgrade than the two releases before it. Follow the how to update OpenClaw guide, take a backup first, and then do the two-line check:
# after upgrade, for each agent that handles anything sensitive
tools.sessions.visibility = "self"
# and decide, deliberately, whether swarm stays on
The repo is at roughly 389,000 stars, 81,800 forks, about 4,000 open issues, and 2,400 open pull requests as of this week. That's the project's second consecutive 1,200-plus PR release. The cadence is the cadence. If reading a changelog this size every three weeks is starting to feel like a second job, we wrote about update fatigue because we felt it too, and it's a big part of why BetterClaw runs managed OpenClaw-compatible agents where the upgrade, the backup, and the session isolation are handled for you. Free plan, bring your own keys.
What this release is really about
Two threads run through 1,247 PRs. One is "make it not lose your stuff": settings, replies, backups, cron output, plugin state. The other is "let agents do more, together": swarm on, sessions shared, Astra steering, teammates in the thread.
Those pull in opposite directions, and that's fine. The project is maturing from "a thing that runs" to "a thing that runs unattended," and unattended is where defaults matter most. The question to ask after this upgrade isn't "what's new." It's "what did I just say yes to."
If any of this resonated, give BetterClaw a try. The free plan gives you one agent and 100 credits a month, bring your own API keys, no inference markup, and it never asks for a card. Pro is $49 a month for five agents, or $39 a month billed annually. Managed hosting, per-agent isolation, and upgrades you don't have to babysit. Start free or see full pricing.
Frequently Asked Questions
What is the OpenClaw 2026.9.2 update? OpenClaw 2026.9.2 is the release tagged on September 5, 2026, covering 1,247 pull requests. Its headline changes are GPT-6 Astra support, Swarm sub-agent orchestration enabled by default, cross-agent session visibility enabled by default, upgrades that preserve settings and default-agent ownership, replies that survive Gateway restarts, and stricter backup integrity checks.
How does OpenClaw 2026.9.2 compare to the April 2026.4.7 release? The April 2026.4.7 update was largely about stability after the CVE wave earlier in the year. 2026.9.2 is about multi-agent behaviour and operator reliability: it flips two defaults (swarm and session visibility), adds Astra, and fixes the upgrade path itself. If you skipped several releases, upgrade in order and read both.
How do I stop agents reading each other's sessions after updating?
Set tools.sessions.visibility to self (only its own sessions) or agent (its own agent's sessions) in the config for any agent that shouldn't see others. The release makes all-session visibility the default and enables ordinary agent-to-agent access, while keeping existing tool and sandbox restrictions in place.
Is it worth upgrading to 2026.9.2 if my setup is working? Yes, mainly for the reliability fixes: settings and skills survive automatic updates, queued and delegated replies recover after restarts, and backups reject corrupt archives instead of accepting partial ones. Take a backup first, then upgrade, then check the two new defaults. The Doctor migration path was fixed in this same release, which lowers the risk of the upgrade itself.
Is Swarm safe to leave on by default? For supervised use, generally yes; opt-outs, tool restrictions, and the separate Code Mode opt-in all still apply. For unattended agents with access to credentials or outbound channels, treat it as a decision: concurrent sub-agents can obey a bad instruction several times over, so pair it with per-agent role files, approval gates on risky actions, and a per-agent cost cap.
