OpenClaw 3.8 Update Explodes: Four Major Events, Finally Know Who's Talking to It

Lead: provenance for agent instructions

OpenClaw 3.8 radically tightens provenance for autonomous agents by introducing an ACP (Agent Communication Protocol) traceability mechanism — so each instruction now carries an "ID card" the agent can use to tell who issued it, from which entry point, and whether it has permission. It has been reported that the new release arrived extremely quickly after 3.7 (v3.7 on March 8; v3.8 on March 9), a tempo that raises a simple question: how fast do you need to move to keep up with AI tooling development?

What changed in practical terms

The release bundles several practical fixes and ergonomics improvements. Administrators gain options like --only-config and --no-include-workspace and proactive backup prompts before dangerous operations (upgrades, resets). TalkMode silence timeout is now configurable (talk.silenceTimeoutMs) so slower speakers won't get cut off; the TUI will auto-detect light terminal backgrounds (or force via OPENCLAW_THEME=light); and Podman + SELinux compatibility is improved by auto-adding :Z labels where needed. It has been reported that Brave Search can now return LLM-friendly context via an LLMContext endpoint, and that the GPT-5.4 setting under openai-codex mode was corrected to a 1.05 million-token context window with a 128,000-token max output.

Security fixes and disclosure posture

Official notes did not enumerate individual vulnerabilities — standard practice to avoid handing a playbook to attackers — but it has been reported that the release includes 12+ security fixes. The release also shifts upgrade workflows from a “leap of faith” to a more recoverable process: instead of only warning users, the software now nudges them to back up and lets them exclude workspace data when appropriate.

Why this matters

Fast, iterative updates like this are a sign of an active open-source community driving agent infrastructure forward. For Western readers: these projects matter globally, not least because rapid open-source advances sit alongside export controls and geopolitical scrutiny of advanced AI tooling and hardware — a tension policymakers are watching. Who is talking to your agents? With ACP, the software finally starts to answer that question.