chatgpt-on-wechat

v2.1.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo AI Agents & Assistants

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

ai ai-agent ai-agents chatgpt-on-wechat claude claude-code

+10 more

codex cowagent deepseek harness llm mcp multi-agent openai openclaw skills

Affected surfaces

auth breaking_upgrade

ReleasePort's take

Moderate signal

editorial:auto 1mo

Release 2.1.1 adds Self‑Evolution for automatic background conversation improvement and hardens deployment security by restricting credential files to ~/.cow/.env while rejecting empty wechatmp_token webhook requests.

Why it matters: The new Self‑Evolution feature enables continuous refinement of interactions, and the security fix (severity 80) limits credential exposure to a protected path, requiring immediate review of any existing deployments using wechatmp_token webhooks.

Summary

AI summary

Updates 🧩 Cross-platform MCP Enhancements, 🛠 Improvements & Fixes, and https://docs.cowagent.ai/memory/self-evolution across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	High	Hardens deployment security by restricting credential‑file block to ~/.cow/.env and rejecting empty wechatmp_token webhook requests. Hardens deployment security by restricting credential‑file block to ~/.cow/.env and rejecting empty wechatmp_token webhook requests. Source: llm_adapter@2026-06-09 Confidence: high	—
Feature
Feature	Medium	Enhances Web Console with message edit, delete, regenerate, parallel sessions, and drag‑and‑drop file support. Enhances Web Console with message edit, delete, regenerate, parallel sessions, and drag‑and‑drop file support. Source: llm_adapter@2026-06-09 Confidence: high	—
Feature	Medium	Enables concurrent calls for sse and streamable‑http transports in MCP for faster multi‑tool responses. Enables concurrent calls for sse and streamable‑http transports in MCP for faster multi‑tool responses. Source: llm_adapter@2026-06-09 Confidence: high	—
Feature	Medium	Adds MiniMax-M3 as default model while keeping M2.7 series available. Adds MiniMax-M3 as default model while keeping M2.7 series available. Source: llm_adapter@2026-06-09 Confidence: high	—
Feature	Medium	Adds support for Qwen3.7‑plus multi‑modal conversations. Adds support for Qwen3.7‑plus multi‑modal conversations. Source: llm_adapter@2026-06-09 Confidence: high	—
Feature	Medium	Adds Self-Evolution feature enabling automatic background review and improvement of conversations. Adds Self-Evolution feature enabling automatic background review and improvement of conversations. Source: llm_adapter@2026-06-09 Confidence: low	—
Feature	Medium	Adds selectable and persistent ASR model option in Web Console. Adds selectable and persistent ASR model option in Web Console. Source: llm_adapter@2026-06-09 Confidence: low	—
Feature	Medium	Adds Windows compatibility fix for stdio communication and configurable server timeout in MCP. Adds Windows compatibility fix for stdio communication and configurable server timeout in MCP. Source: llm_adapter@2026-06-09 Confidence: low	—
Feature	Low	Introduces Self‑Evolution enabling automatic background review, skill creation, task follow‑up, and memory updates after conversation idle. Introduces Self‑Evolution enabling automatic background review, skill creation, task follow‑up, and memory updates after conversation idle. Source: granite4.1:30b@2026-06-09-audit Confidence: low	—
Feature	Low	Allows selecting and persisting the ASR (speech recognition) model in the Web Console settings. Allows selecting and persisting the ASR (speech recognition) model in the Web Console settings. Source: granite4.1:30b@2026-06-09-audit Confidence: low	—
Feature	Low	Adds group task board plugin source to CowAgent. Adds group task board plugin source to CowAgent. Source: granite4.1:30b@2026-06-09-audit Confidence: low	—
Bugfix	Medium	Fixes Python 3.13 installation and dependency compatibility issues. Fixes Python 3.13 installation and dependency compatibility issues. Source: llm_adapter@2026-06-09 Confidence: high	—
Bugfix	Medium	Improves cancellation reliability for streaming replies. Improves cancellation reliability for streaming replies. Source: llm_adapter@2026-06-09 Confidence: high	—

Full changelog

🌐 English | 中文

🧬 Self-Evolution

CowAgent introduces Self-Evolution, letting the agent go beyond completing a single task and keep improving through everyday collaboration with you:

Automatic review after idle: Once a conversation goes idle, the agent reviews it in the background to fix problems a skill exposed in use, create reusable new skills, follow up on unfinished tasks, and record important information into memory and the knowledge base
Silent by default, notify on demand: It reports what it changed only when it actually made a change, and stays silent otherwise
Safe and reversible: Every review is backed up beforehand and can be undone at any time. Built-in skills are protected, and all reads and writes stay within the workspace

Enabled by default for new installs. Existing users can turn it on with a single click in the Web Console under Settings → Agent Config.

Documentation: Self-Evolution

💬 Web Console Upgrades

The Web Console chat experience gets several enhancements:

Message management: Edit, delete, and regenerate both user and bot messages; code blocks now include language labels and a one-click copy button
Parallel sessions: Run multiple sessions at the same time without interference, with live streaming automatically resumed when you switch back to a session
Refinements: Drag and drop files anywhere in the chat view; automatically switch to a sibling session after deleting the active one

Thanks @core-power (#2865)

🧩 Cross-platform MCP Enhancements

Windows compatibility fix: Fixed stdio communication failing on Windows, and made the server timeout configurable via mcp.json
Concurrent calls: The sse and streamable-http transports now support concurrent calls across sessions for faster multi-tool responses

Thanks @xliu123321 (#2859)

Documentation: MCP Tools

🤖 New Models & Improvements

MiniMax-M3: Added and set as the default model, with the M2.7 series kept as an option. Thanks @octo-patch (#2855)
Qwen3.7-plus: Added support for multi-modal conversations
Selectable ASR model: The Web Console can now select and persist the ASR (speech recognition) model. Thanks @nightwhite (#2857)
Simplified install menu: The one-line install script streamlines the model menu and adds the Xiaomi MiMo option

Documentation: Models Overview

🛠 Improvements & Fixes

Python 3.13 support: Fixed installation and dependency compatibility on Python 3.13
Internationalization: The channel list is now ordered by the interface language; refined the automatic language fallback under auto mode
More reliable cancellation: Fixed cases where a streaming reply could not be interrupted
CLI: cow status now shows the current project path
Hardened deployment security: The credential-file block is narrowed to ~/.cow/.env so other directories are no longer affected (Thanks @orbisai0security #2863); the WeChat Official Account now rejects webhook requests when wechatmp_token is empty
Group task board plugin: Added the group task board plugin source. Thanks @Wyh-max-star (#2853)

📦 Upgrade

Source-code deployments can run cow update for a one-click upgrade, or pull the latest code and restart manually. See the Upgrade Guide for details.

Release Date: 2026.06.09 | Full Changelog

Security Fixes

Credential‑file block narrowed to ~/.cow/.env; WeChat webhook rejects requests when wechatmp_token is empty

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track chatgpt-on-wechat

Get notified when new releases ship.

About chatgpt-on-wechat

CowAgent是基于大模型的超级AI助理，能主动思考和任务规划、访问操作系统和外部资源、创造和执行Skills、通过长期记忆和知识库不断成长，比OpenClaw更轻量和便捷。同时支持微信、飞书、钉钉、企微、QQ、公众号、网页等接入，可选择OpenAI/Claude/Gemini/DeepSeek/ Qwen/GLM/Kimi/LinkAI，能处理文本、语音、图片和文件，可快速搭建个人AI助理和企业数字员工。

All releases →