OpenClaw Security Advisories: 722 Fixes and Git 2.56 Hardening

Two security stories, one ecosystem

OpenClaw, which GitHub describes as the fastest-growing project in its history, has published unusually detailed figures on its vulnerability intake 52. In the same stretch, Git 2.56 shipped with a set of robustness changes that are easier to miss 54.

The two stories share a theme. In both projects, much of the security work is unglamorous: sorting signal from noise, tightening edge cases, and keeping a tool predictable when inputs go wrong.

What OpenClaw is disclosing

OpenClaw's security page says there are currently no active bulletins. It reports no known compromise of project infrastructure or of the official install and update channels 2. That claim covers the core project, its apps, and the hosted installers. It explicitly excludes third-party skills distributed through ClawHub 2.

The numbers are what stand out. Since January 2026, the project has received 1,799 reports 2. About 58% were closed without an advisory as invalid, duplicate, or working as designed 2. Another 722 issues were fixed and published, and 39 of those carry a CVE 2.

On critical severity, 137 reports were filed as critical, but 123 were invalid, duplicates, or out of scope 2. That leaves 14 confirmed criticals, all of which the project says are fixed and disclosed 2.

The page also notes that filing a report does not mean a vulnerability exists 2. That caveat explains the gap between submissions and confirmed issues. The published fixed and closed figures do not quite add up to the total, which suggests some reports are still in triage. The page does not break that remainder out.

A policy built to filter noise

OpenClaw's GitHub security policy explains how it handles volume. It says the most useful reports show a current, reproducible boundary bypass with demonstrated impact 1. It is equally clear about what usually does not count [1]:

• raw scanner output
• prompt-injection-only chains
• scenarios that rely on hostile users sharing a single trusted gateway

The public intake guidance asks reporters for four things [2]:

• the affected version and code location
• reproduction steps on the latest release or main
• the attacker's gain and which trust boundary is crossed
• a patch, where possible

Reports go to the specific repository involved. That means openclaw/openclaw for the CLI, gateway, and macOS, iOS, and Android apps, and openclaw/clawhub for ClawHub 1. Core issues should come through private GitHub Security Advisories, and anything else goes to security@openclaw.ai 12. Maintainers reserve the right to take down public issues or pull requests that expose unpatched flaws or exploit details 1.

The project says security work is shared among several maintainers, including engineers and researchers from NVIDIA and Tencent 12.

The 123-of-137 figure is the most telling in my view. For a viral AI-agent project, the bottleneck is less finding bugs than spending maintainer time on triage. A strict threat model and structured intake form look like deliberate defenses against that load. The cost is that OpenClaw is drawing its own line around what counts as a vulnerability, and the ClawHub skills exclusion leaves a real part of the user experience outside the headline guarantee.

Git 2.56: hardening without the fanfare

Git 2.56 is a quarterly release with 748 non-merge commits from 104 contributors, 39 of them first-timers 3. The release notes do not frame it as a security release. Several changes still improve resilience:

• Merge backend: the default ort merge backend now aborts on corrupt trees instead of pressing on 4.
• Config locking: configuration file locking retries briefly, so simultaneous writers no longer fail outright 4.
• Promisor remotes: the other side of a connection can add promisor remotes through a new promisor.acceptFromServerURL setting 4. This is opt-in, and administrators may want to review it carefully.
• Conflict safety: a new git add --resolved mode checks unmerged paths for leftover conflict markers and refuses to stage anything if it finds them 3.

Other additions are about features and performance 3[4]:

• a history-rewriting operation that aborts rather than overwriting local work
• faster merge-base calculations
• path-walk repacking that now works with server-side bitmaps
• a remote-object-info command that fetches object metadata over protocol v2 without downloading the object
• git repack --drop-filtered for pruning large local promisor blobs

The takeaway

Neither story involves an active breach. OpenClaw's transparency is useful, especially the honest ratio of noise to confirmed criticals. Readers should still treat the "no active bulletins" status as scoped, not universal.

Git 2.56 is a reminder that defensive engineering often arrives as stricter error handling and safer defaults rather than CVEs. For teams running either tool, the practical advice is the same: stay on current releases, and read the scope notes carefully.