OpenClaw v2026.3.28 Drops — MiniMax Image Generation, xAI Upgrade, and Major Plugin Overhaul

TLDR:

• OpenClaw v2026.3.28 introduces MiniMax image generation (image-01 model) with aspect ratio control
• xAI/Grok moves to Responses API with integrated x_search — no more manual plugin setup
• Plugin hooks get async approval system — pause tool execution for user confirmation before running
• Qwen portal OAuth deprecated — users must migrate to Model Studio with new API key auth
• WhatsApp infinite echo loop finally fixed after self-chat DM bug

The Big Features

MiniMax Image Generation — Finally Here

MiniMax users have been waiting for this. OpenClaw v2026.3.28 adds native image generation support for MiniMax’s image-01 model, including both text-to-image generation and image-to-image editing. You can now control aspect ratio directly from OpenClaw without third-party workarounds.

The implementation comes with full generate and edit modes, which means OpenClaw agents can now produce visual outputs as part of their workflows — logos, thumbnails, diagrams, and more. For content teams running OpenClaw, this closes a major gap.

xAI/Grok Gets a Major Upgrade

Grok’s integration has been completely revamped. OpenClaw now routes xAI through the Responses API and adds first-class x_search support. The bundled Grok web-search plugin now auto-enables when you configure xAI, meaning search functionality works out of the box without manual plugin toggling.

The onboarding flow also gets x_search setup built in — during `openclaw onboard` or `openclaw configure –section web`, users get an x_search model picker with shared xAI key configuration. If you’re running Grok, this update makes everything Just Work.

Plugin System Gets Serious

Async Approval Hooks — Pause Before You Execute

This is a big one for security-conscious deployments. Plugin hooks can now call `requireApproval` from `before_tool_call`, which pauses tool execution and prompts the user for approval. Users can approve via the exec approval overlay, Telegram buttons, Discord interactions, or the `/approve` command on any channel.

In practice: if a plugin tries to run a potentially sensitive tool (sending a message, executing code, accessing files), it can now stop and ask first. The `/approve` command handles both exec approvals and plugin approvals with automatic fallback. This makes role-based permission systems much more practical.

CLI Backends — Claude, Codex, and Gemini Now Bundled

The Claude CLI, Codex CLI, and Gemini CLI inference defaults have moved onto the plugin surface. Gemini CLI backend support is now bundled by default. Setup no longer requires manual `plugins.allow` entries — auto-loading handles it.

The old `gateway run –claude-cli-logs` flag has been replaced with the generic `–cli-backend-logs` (with the old flag kept as a compatibility alias). If you’re running any of these CLI backends, the migration is seamless.

apply_patch Enabled by Default for OpenAI

OpenAI and OpenAI Codex models now have apply_patch enabled by default. This OpenAI feature allows models to modify and improve code files directly — essentially giving the model a way to edit its own codebase. It also aligns sandbox policy access with write permissions.

Breaking Changes — Check Your Config

Qwen Portal OAuth Removed

The deprecated qwen-portal-auth OAuth integration for portal.qwen.ai has been removed. If you’re still using the old Qwen portal authentication, you need to migrate to Model Studio with `openclaw onboard –auth-choice modelstudio-api-key`. This was expected — the deprecation notice has been out for a while — but if you’re running Qwen, update now.

Old Config Migrations No Longer Auto-Fix

OpenClaw no longer automatically migrates config keys older than two months. Previously, old legacy keys would be rewritten on load or by `openclaw doctor`. Now, very old legacy keys fail validation instead. Run `openclaw doctor` to check your config before upgrading if you’re running an older setup.

Bug Fixes That Matter

• WhatsApp Echo Loop Fixed — The infinite echo loop in WhatsApp self-chat DM mode has been resolved. Previously, the bot’s own outbound replies were being re-processed as new inbound user messages, causing loops. If you use WhatsApp with OpenClaw, this was likely a known pain point.
• Telegram Message Handling — Three Telegram fixes in this release: long HTML messages now split at word boundaries instead of mid-word, empty text replies are suppressed before delivery to prevent crashes, and replyToMessageId validation is now consistent across all four API sinks.
• Image Analysis Restored — Both the generic image-runtime fallback and Codex image tool registration have been fixed. If you were seeing image analysis failures on providers like openrouter or minimax-portal, this should resolve those.
• Auto-Reply Envelopes Fixed — JSON-wrapped `{“action”:”NO_REPLY”}` control envelopes are now suppressed before channel delivery. Media-only messages that previously got wrapped in empty text envelopes now send cleanly.

Other Notable Changes

• Memory plugins — pre-compaction memory flush is now managed by the active memory plugin contract instead of hardcoded core logic
• ACP channels — Discord, BlueBubbles, and iMessage now support current-conversation ACP binds for spawning Codex workspaces without child threads
• Config schema — `openclaw config schema` now prints the generated JSON schema for openclaw.json
• Matrix TTS — voice replies now send as native Matrix voice bubbles instead of generic audio attachments
• Slack file uploads — explicit upload-file action with optional filename/title/comment overrides
• Claude/Anthropic — unhandled provider stop reasons now return structured errors instead of crashing the agent run

Our Take

v2026.3.28 is a substantial release hiding behind a routine version number. The MiniMax image generation alone makes this worthwhile for MiniMax users — native image generation closes a feature gap that’s been a pain point. The xAI/Grok overhaul makes that integration genuinely plug-and-play.

The plugin approval hooks are the real security story. Running multiple agents with varying permission levels just got safer. The async `requireApproval` system means you can build workflows that ask before acting, rather than hoping the initial configuration is right.

The breaking changes are manageable — Qwen portal migration was already deprecated, and the config migration change mainly affects old setups. The WhatsApp echo loop fix alone makes this upgrade worth it if you’re on WhatsApp.

If you’re running OpenClaw, this release is recommended. The full changelog runs deep, but the highlights — image generation, xAI upgrade, plugin security — make real differences in day-to-day use.

Source:
– OpenClaw v2026.3.28 Release Notes