OpenClaw users, this is a heads-up you actually need to read. Today, June 25, 2026, TechRadar reported that five new malicious skills on ClawHub have been identified and removed — the latest wave in an ongoing supply-chain attack campaign targeting OpenClaw’s skill marketplace. Two of the packages delivered macOS infostealers capable of exfiltrating credentials, crypto wallets, browser data, and your OpenClaw configuration files. This is directly relevant to you if you install skills from ClawHub. And frankly, most OpenClaw users do. ...

Sakana AI has a new product and an ambitious premise: one API to command them all. Fugu — the Tokyo-based lab’s latest release — is a multi-agent orchestration system that internally routes across a pool of specialist models to handle complex, multi-step tasks, while exposing a single OpenAI-compatible API to the developer. You send a request; Fugu decides which combination of models handles it best. The product launched officially on June 22, 2026, and has already attracted enough users to create wait times on its premium tier. ...

If you’ve ever accidentally /cleared your way out of a long, context-rich coding session, Claude Code 2.1.191 was built for you. Anthropic shipped this release on June 24, 2026, packing 20 CLI changes into a single update — and two of them are particularly significant for anyone running serious agentic workflows. The /rewind Command: Context Recovery Made Simple The headline feature is /rewind. Previously, if you issued a /clear command inside a Claude Code session — whether intentionally or by accident — your prior conversation context was gone. The agent had no way to recover the thread of reasoning that led to where you were. ...

Most agents are amnesiac by default. Each session starts fresh, with no memory of what worked, what failed, or what preferences the user already expressed. It’s one of the most consistent sources of friction in production agentic systems — and LangChain’s Jake Broekhuizen published a detailed practical guide on June 24, 2026, showing how to close that loop. The pattern centers on three LangSmith components working in sequence: Observability (capture traces), Engine (analyze them), and Context Hub (store durable memory). The result is an agent that genuinely learns from experience rather than asking users to repeat themselves every session. ...

OpenClaw 2026.6.11 is the most substantial stable release this platform has shipped in months. Landing on June 24, 2026, it consolidates 305 merged pull requests from the v2026.6.10 history and delivers a cluster of features that meaningfully expand what operators can do with channels, remote workflows, and mobile management. Here’s what’s new and why it matters. Slack Relay Mode: Separating Ingress from the Gateway The most architecturally interesting addition is Slack relay mode, activated with mode: relay in your channel configuration. In standard Slack integration, the OpenClaw gateway receives and responds to messages directly. Relay mode changes this: it separates the ingress (message receiving) from the gateway itself, creating a clean handoff model for managed or multi-tenant setups. ...

As AI agents proliferate in enterprise environments, a question that’s moved from theoretical to urgent: how do you verify that an agent is actually doing what it claims to do? Exabeam shipped an answer to that question on June 24, 2026, in the form of Praxen — an open-source tool that implements Agent Behavior Verification (ABV). The core premise is straightforward: every agent should have an authorized role, and there should be a systematic way to confirm the agent’s actual behavior matches that authorization. Praxen operationalizes this. ...

Pydantic AI has been one of the more quietly serious agent frameworks in the Python ecosystem — rigorous type safety, predictable behavior, and a clear design philosophy that doesn’t chase every trend. On June 23, 2026, the team shipped v2.0.0 stable to PyPI, and it represents the clearest statement yet of where they think the agent layer should live. The headline change is the capability primitive. But to understand why it matters, it helps to understand what it replaces. ...

If you’ve ever tried to authenticate an MCP server over SSH — staring at a browser prompt that simply won’t open on a headless remote box — Claude Code v2.1.186 just fixed your pain. This release, published June 22, 2026 by Anthropic, is one of those quietly consequential drops that makes day-to-day multi-agent development meaningfully smoother. The Headliner: claude mcp login and --no-browser The new claude mcp login <name> and claude mcp logout <name> commands give you direct CLI-driven authentication for MCP servers, with no browser required when you pass --no-browser. For anyone running Claude Code on a remote VM, a CI/CD runner, or any SSH-accessed server, this is a genuine quality-of-life win. Before, browser-based auth flows were a blocking step for headless setups. Now you can authenticate MCP servers entirely from a terminal session — the way server tooling should work. ...

OpenClaw’s ClawHub skill marketplace has a supply chain problem — and it’s more sophisticated than the scanner-bypass techniques you’ve seen before. A June 23, 2026 report from Palo Alto Networks Unit 42 found five malicious skills that slipped past VirusTotal, ClawScan, and every other automated security check from February through May 2026, ultimately delivering macOS infostealers and pioneering two attack categories the security industry hadn’t named before. This isn’t an isolated finding. It’s one piece of a larger security picture that also includes a separate research disclosure by AIR security showing how mutable external links can let approved skills swap their payloads post-approval — all covered in today’s companion piece. ...

It’s not enough to pass the scan on the day you submit. If your skill can swap its instructions after approval, you were never really vetted at all. That’s the lesson from a June 23, 2026 disclosure by AIR security researchers, who built a fake AI agent skill called brand-landingpage, submitted it through multiple marketplace approval pipelines — including Cisco, NVIDIA, and skills.sh — and watched it sail through every automated check. The trick: at submission time, the skill’s external instruction source pointed to benign Stitch documentation. After approval, AIR swapped the payload. The skill then reportedly reached approximately 26,000 agent installs before the researchers disclosed the technique. ...