Welcome to your agent platform research briefing for Monday, April 13th, 2026.

**OpenClaw 2026.4.11 — ChatGPT Import, Rich Webchat, and Five Days of Updates** — OpenClaw wrapped an extraordinary week of shipping, pushing five releases in five days — versions 4.7 through 4.11. The latest, 2026.4.11, adds a ChatGPT conversation import tool to the Dreaming and Memory Wiki system, letting users migrate their ChatGPT history into OpenClaw's memory architecture. The UI gets two new tabs: "Imported Insights" and a "Memory Palace" view. Webchat now renders rich structured chat bubbles instead of plain text, with a new embed tag for external URL previews. Video generation gets improved URL delivery. Under the hood, 4.10 was arguably the bigger release — it debuted the Active Memory plugin, which runs a dedicated memory sub-agent before each reply to automatically pull relevant context without users having to manually say "remember this." MLX local speech synthesis also landed in Talk Mode for macOS users who want fully offline voice. The pace has drawn attention from the Chinese tech press, with one outlet describing the team as a group that clearly never sleeps.

**Claude Mythos Triggers UK Regulatory Panic — And Some Skepticism** — Anthropic's withheld cybersecurity model Claude Mythos Preview, which was first reported last week for finding 181 working Firefox exploits, has now set off a transatlantic regulatory scramble. UK financial regulators — including the Bank of England, the FCA, and the National Cyber Security Centre — are reportedly rushing to brief major banks and insurers on the risks. A meeting with representatives from British banks, insurers, and exchanges is expected within the fortnight. US regulators have also taken coordinated action with Canada. A Reform UK Member of Parliament wrote to the government urging engagement with Anthropic over what he called catastrophic cybersecurity risks. At the same time, The Guardian ran a skeptical deep-dive arguing that Anthropic — despite the substance of the Mythos capabilities — is also exceptionally good at marketing, and that Dario Amodei has, in the words of one critic, graduated from the same school of hype as Sam Altman. The story remains genuinely two-sided: the model capability appears real based on independent corroboration, but the PR rollout has been unusually orchestrated.

**MCP Security: Critical aws-mcp-server CVE Plus Chatbox Command Injection** — Two new vulnerabilities in the MCP ecosystem surfaced over the weekend. The more serious is CVE-2026-5058, a critical command injection flaw in the popular aws-mcp-server package carrying a CVSS score of 9.8. No authentication is required for exploitation — an attacker with network access to the server can inject arbitrary OS commands via the allowed-commands string and achieve remote code execution. No public proof-of-concept exists yet, but the advisory confirms the exploit path is straightforward. If you're running aws-mcp-server in any internet-facing configuration, treat this as urgent. The second vulnerability, CVE-2026-6130, hits Chatbox — the popular AI assistant desktop app — specifically its MCP stdio transport layer. It's rated High at 7.3. Manipulation of the args and env arguments in the StdioClientTransport function can lead to OS command injection remotely. The vendor had been notified via GitHub issue but had not responded as of disclosure. Both CVEs were published April 11 to 12. This continues a pattern of MCP ecosystem security issues — the third and fourth MCP-related CVEs in just the past two weeks.

That's your briefing for Monday, April 13th. Stay patched out there.