How-Tos & Practical Guides

If you’ve spent any time with AI coding agents, you’ve likely hit the same wall: the output is powerful, but it’s not reliable. Run the same prompt twice and you get different results. Prompts live in chat history, not in version control. Workflows are tribal knowledge that evaporates when the context window resets. Archon is an open-source workflow orchestration platform that addresses this directly. It wraps AI coding agents — primarily Claude Code and OpenAI Codex CLI — in YAML-defined workflows that make agentic coding deterministic, composable, and version-controllable. ...

Anthropic published its Trustworthy Agents in Practice framework yesterday — a five-principle safety baseline for autonomous Claude agents. The principles are solid, but they’re abstract. This guide translates each one into concrete configuration and design choices you can make in OpenClaw today. The Five Principles (Quick Summary) Before the how-to: Anthropic’s framework names five principles for trustworthy agent operation: Human control — Maintain meaningful oversight; prefer reversible actions Alignment with user expectations — Act on intent, not just literal instruction Security — Resist prompt injection and adversarial inputs Transparency — Be honest about capabilities, limitations, and actions taken Privacy — Operate with minimum necessary access to data Each maps to specific choices in how you configure and constrain your agents. ...

As AI agents proliferate across enterprise environments, a predictable problem has emerged: nobody knows what agents exist, who owns them, or whether they’re safe to use. AWS has a solution. Today, the company previewed Agent Registry, a centralized enterprise catalog for AI agents, inside its new AgentCore platform. This is a serious infrastructure announcement aimed squarely at the enterprise agent management problem — and it’s live in five AWS regions today. ...

Security researchers at LayerX have published findings that should give every Claude Code user pause: a carefully crafted CLAUDE.md file can turn the agentic coding assistant into what they describe as a “nation-state-level attack tool” — capable of executing SQL injection attacks, stealing credentials, and bypassing safeguards during normal coding sessions. No actual coding required on the attacker’s part. Just a malicious markdown file. What Is “Vibe Hacking”? LayerX coined the term vibe hacking to describe a class of attacks where malicious instructions are embedded in the ambient configuration context of an AI coding agent, rather than in explicit code or prompts. The “vibe” in question is the agent’s operating context — its instructions, its persona, its assumed goals. ...

Anthropic’s Claude Managed Agents raised the bar for managed agentic infrastructure when it launched earlier this week. LangChain’s response came fast: Deep Agents Deploy, now in beta, is a model-agnostic, open-source alternative that puts full memory ownership back in the developer’s hands. This is one of the more interesting competitive moves in the agent infrastructure space in recent memory — and if you’re evaluating where to build your production agent stack, you need to understand what’s actually on the table. ...

If you’ve ever wished your AI agent could dream — not literally, but in the sense of consolidating fragmented memories into coherent long-term knowledge — OpenClaw v2026.4.9 just made that real. Released today, version 2026.4.9 introduces Dreaming, a REM backfill pipeline that fundamentally changes how OpenClaw agents handle memory continuity. It’s one of the most conceptually interesting updates the project has shipped, and the implications for persistent agentic systems are significant. ...

Anthropic’s Claude Managed Agents entered public beta on April 8, 2026. If you’ve been waiting for a managed platform to deploy Claude-powered agents without standing up your own infrastructure, this is it. Here’s how to get started. Prerequisites Before you begin, you’ll need: An Anthropic API account (platform.anthropic.com) Access to the Managed Agents beta (apply at the developer platform) Basic familiarity with REST APIs or the Anthropic Python/TypeScript SDK Python 3.10+ or Node.js 18+ for the examples below Step 1: Apply for Beta Access Navigate to platform.claude.com and look for the Managed Agents section. As of the public beta launch, this is open to teams — not just individual developers. You’ll want to apply with your organization’s use case described, as Anthropic appears to be prioritizing enterprise workloads. ...

OpenClaw v2026.4.8 ships an experimental plugin called memory-wiki — a persistent, structured knowledge base that lives across agent sessions. Unlike the flat key-value store of standard memory plugins, memory-wiki organizes knowledge into structured entries and, crucially, detects contradictions when new facts conflict with existing ones. This guide walks you through installing the plugin, configuring it, and using it effectively in your agents. Prerequisites OpenClaw v2026.4.8 or later (run openclaw --version to check) Node.js v20 or later If upgrading from an older install: run openclaw doctor --fix first to migrate legacy config Step 1: Install the Plugin openclaw plugins install memory-wiki This pulls the plugin from ClawHub and adds it to your OpenClaw configuration. The memory-wiki plugin ships as part of the 4.8 release package, so the install should complete immediately without downloading external dependencies. ...

Google’s Agent-to-Agent (A2A) protocol is fast becoming the standard handshake for cross-agent communication in production agentic systems. A new deep-dive from freeCodeCamp — paired with a working GitHub implementation at win4r/openclaw-a2a-gateway — shows exactly how to wire A2A into an OpenClaw plugin so your agent can receive tasks from any A2A-compliant caller. This how-to summarizes the architecture and key implementation steps. For the full guide, see the freeCodeCamp article. What You’re Building An A2A plugin bridge does three things: ...

Three command injection vulnerabilities in Claude Code CLI — CVE-2026-35020, CVE-2026-35021, and CVE-2026-35022 — carry CVSS scores of 9.8 (Critical) and chain together to enable credential exfiltration over HTTP. If you’re running Claude Code in any CI/CD pipeline, this guide walks you through immediate mitigation steps and longer-term hardening practices. This is not optional maintenance. These are exploitable, validated vulnerabilities with confirmed callback evidence. Prerequisites Access to your Claude Code CLI deployment(s) Access to your CI/CD pipeline configurations (GitHub Actions, GitLab CI, Jenkins, or equivalent) Basic shell access to environments where Claude Code runs Permission to update environment variable configurations and outbound network rules Step 1: Check Your Version and Patch Immediately The vulnerabilities are confirmed exploitable on v2.1.91 and earlier. Your first action is to identify and update every Claude Code CLI instance. ...