Why OpenClaw Stopped Using Tools: tools.profile Explained

The most important setting in an AI agent is not its model. It is the default amount of permission you let it feel.

On March 3, 2026, OpenClaw changed more than a config default. It changed the emotional contract between user and machine.

For months, OpenClaw sold a specific fantasy to the market: you ask, it acts. Not just answers. Not just plans. It edits files, runs commands, checks logs, orchestrates tools, and returns with work completed.

Then came v2026.3.2.

According to the official release notes and the updated onboarding documentation, new local installs now default to tools.profile: messaging. In practice, that means a fresh install no longer starts with broad runtime and filesystem powers. The agent can still talk. It can still maintain session context. But the default experience no longer feels like an operator with hands on the keyboard.

Technically, this is a safer default. Emotionally, it feels like something else entirely: the day your agent became a chatbot.

The Day the Magic Broke

Across public Reddit threads, Answer Overflow discussions, and community help channels sampled between March 3 and March 6, 2026, the same scene repeats in different words.

Somebody upgrades or installs OpenClaw.

They ask it to do something ordinary:

inspect a file
run a command
patch code
take the next step without supervision

Instead of acting, the agent explains. It suggests. It narrates intent. It sounds helpful. It sounds fluent. And yet the user walks away with the same disappointed summary: it talked, but it did not work.

That subtle distinction matters more than many product teams realize. Users do not adopt OpenClaw to buy one more eloquent interface. They adopt it to buy delegated labor.

Once that delegated labor becomes opt-in instead of ambient, the product crosses an invisible line:

Before the default change	After the default change
“It feels like a teammate.”	“It feels like a chat surface.”
“I ask once and it gets moving.”	“I ask once and it explains constraints.”
Errors feel like effort in progress.	Refusals feel like the work never started.
Trust comes from visible execution.	Doubt comes from missing action.

This is why the community reaction sounded stronger than a normal configuration complaint. Users were not merely reporting a setting mismatch. They were reacting to an identity break.

What Actually Changed in OpenClaw v2026.3.2

The public discourse around this update quickly turned fuzzy. Some people described it as if “tools were removed.” That is not quite right.

The official configuration reference distinguishes tool groups and profiles. The messaging profile keeps messaging-oriented capabilities such as session history and message handling. What it does not include by default is the full set of runtime and filesystem operations users associate with OpenClaw’s most agentic workflows—things like exec, file reads and writes, and patch-style editing.

In other words:

OpenClaw did not stop being capable of tool use.
OpenClaw stopped assuming that a new install should act with broad operational reach.
The burden moved from “explicitly disable dangerous powers” to “explicitly opt into dangerous powers.”

This is a classic security move. It is also a classic onboarding trap.

When the product category is “AI agent,” the user’s first benchmark is not prose quality. It is initiative plus execution. If the first-run experience blocks both, users do not interpret that as careful security posture. They interpret it as the core promise failing in front of them.

GitHub Issue Evidence: This Was Not Just Vibes

The public narrative was quickly backed by real issue reports. In the local issue sync we pulled on March 6, 2026, two reports stand out as especially relevant:

#34810 describes an agent that suddenly lost exec, read, and write, leaving only message and sessions. The reporter explicitly says the agent became a chat-only assistant.
#36968 shows the same regression from another angle: a user asks OpenClaw to read a file in the workspace and gets told the read tool is unavailable.

Even more telling, the discussion on #34810 surfaces a practical workaround that matches the official config semantics: check whether openclaw config get tools returns "profile": "messaging", and if so, switch to "coding" for local agent workflows.

That matters because it turns this from a vague feeling into a traceable product event: users were not imagining the downgrade. They were running into a real post-update policy change with visible operational consequences.

Why the Backlash Felt So Personal

Most software defaults shape convenience. Agent defaults shape personality.

That is the deeper lesson hiding inside the OpenClaw discourse.

If a note-taking app changes its export format, users may grumble. If an AI agent changes its permission posture, users immediately ask a more existential question:

Are you still my operator, or are you now my commentator?

This explains why the loudest complaints were often phrased in emotional, not technical, language. Public threads used terms like “dumb now,” “just chatting,” and “not actually doing anything.” Those are not rigorous diagnostics. They are experience reports. And they point to something real.

People do not experience an agent through its capability matrix. They experience it through a sequence:

I ask.
It begins.
I see evidence.
I regain time.

Break that sequence after step one and the rest of the stack stops mattering.

Three User Stories Hidden Inside the Feedback

The most interesting part of this update is that the backlash was not uniform. Underneath the public frustration, at least three different user stories emerged.

1. The Power User Who Reconfigures and Moves On

For experienced operators, the new default is annoying but survivable. They already understand profiles, permission scopes, and where to regain the missing powers. These users complain, patch their config, and continue.

Their reaction is usually some version of: “why was this changed without a better migration story?”

That is not a churn signal. It is a trust tax.

2. The New User Who Decides the Product Is Mostly Theater

This is the more dangerous story.

A new user does not have historical context. They do not remember the more action-oriented default. They judge the product from the first ten minutes. If those ten minutes are dominated by elegant refusals, they infer that OpenClaw is mostly interface—an AI that can describe work, not complete it.

That perception is incredibly hard to reverse. A product can survive friction. It rarely survives false categorization.

Once a user files you under “chatbot with ambition,” they often never return to discover the deeper configuration surface.

3. The Team Lead Who Cannot Afford Setup Drama

A third public narrative came from people trying to introduce OpenClaw to teammates or non-terminal-native collaborators. Their pain was not the loss of one tool. It was the compounding effect of permissions, setup complexity, and confidence.

An internal champion can explain tools.profile. A team rollout cannot depend on that explanation every time. The moment the first shared demo turns into “let me explain why it cannot do that yet,” momentum evaporates.

This is why AI agent adoption often collapses not on model quality, but on time-to-first-delegation.

Why OpenClaw Did It Anyway

OpenClaw did not make this move by accident.

The wording in the official onboarding docs is revealing: the new default exists to make broad runtime and filesystem access an explicit choice rather than an ambient one. That is a rational response to the security reality of agentic software.

An AI agent with shell access, file access, browser access, and long-lived credentials is not just a productivity tool. It is a concentrated risk surface.

Seen from that angle, tools.profile: messaging is not a betrayal of the product. It is the product team admitting a hard truth:

If agent software is going to act with real authority, users need a more intentional relationship with that authority.

The trouble is that security logic and user psychology do not move at the same speed.

To a security engineer, this update says:

least privilege first
broader powers by consent
safer onboarding for new installs

To a first-time user, the same update says:

this agent hesitates
this agent explains limits
this agent may not be worth delegating to

Both readings are coherent. That is exactly what makes the moment so instructive.

The Real Product Lesson: Default Permissions Are Product Identity

The cleanest way to understand this episode is to stop thinking of permissions as infrastructure.

In AI agents, permissions are interface.

More than that, they are identity design.

The wrong mental model is:

“We changed a default profile.”

The more accurate mental model is:

“We changed what the product feels like in the first conversation.”

That is why this story matters beyond OpenClaw.

The entire agent ecosystem is converging on the same unresolved question:

How do you make an agent feel powerful without making it feel reckless?

Most teams answer one side of the problem.

If they optimize for safety, they ship something correct but underwhelming.
If they optimize for autonomy, they ship something magical but fragile.

The winners will design the missing middle: visible, progressive authority.

That means:

showing why a tool is needed at the moment of need
granting scoped power in language users understand
returning proof of execution, not just promises
making escalation feel deliberate, not hidden
preserving the agent fantasy without lying about the risk

OpenClaw’s March 2026 update is memorable because it demonstrates the opposite in one stroke. The safer default is real. The degraded first impression is also real.

The SEO Question Hidden in the Product Question

If you run an English-language documentation and editorial site, this story is unusually strong for search because it sits at the intersection of several live intents:

“OpenClaw update changed tool behavior”
“What is tools.profile: messaging?”
“Why does OpenClaw only chat and not use tools?”
“How do I restore tool use in OpenClaw safely?”
“What is the difference between an AI chatbot and an AI agent?”

That means the editorial opportunity is larger than one reaction post. This topic can anchor a cluster:

a narrative analysis like this one
a practical migration guide
a security explainer for tool profiles
a troubleshooting article for “agent only talks, does not act”

CoClaw now has exactly that high-intent fix page here: /troubleshooting/solutions/openclaw-only-chats-no-tools-after-update.

For CoClaw specifically, that cluster is already within reach. Users who land here should be able to move naturally into OpenClaw Configuration, Updating and Migration, and Skill Safety and Prompt Injection.

In other words, the article is not only commentary. It is a search bridge between confusion, diagnosis, and action.

FAQ: Why Does OpenClaw Feel Like a Chatbot After the Update?

Did OpenClaw remove tools completely?

No. The more precise change is that new local installs now default to tools.profile: messaging, which narrows the default set of capabilities available on first run. The broader runtime and filesystem tool groups are no longer assumed.

Why did users react so strongly?

Because people evaluate an AI agent through visible action. If the default experience produces explanations instead of execution, users perceive that as a category shift—from agent to chatbot—even when the underlying platform remains configurable.

Is the new default bad?

Not inherently. It is a defensible security choice. The real issue is that safer defaults need a better permission-escalation story, or they will be experienced as broken value.

How should users respond?

Treat the update as a prompt to review your configuration deliberately. Start with the official release notes, then audit your setup through Updating and Migration and OpenClaw Configuration before expanding permissions.

What is the bigger lesson for AI agents?

The first-run experience for an agent must balance authority and legibility. Users need to feel both safe and delegated for the category promise to hold.

The Sentence That Will Matter a Year From Now

This was not a story about a config key.

It was a story about what users believe they are buying when they adopt agent software.

They are not buying better prose. They are buying back time. They are buying initiative. They are buying the feeling that a machine can carry a task forward without collapsing into explanation.

That is why this update landed with so much force.

For a chatbot, saying “no” is often responsible behavior.

For an agent, saying “no” changes the role.

And once the role changes, the product has to earn its identity all over again.

Sources and Further Reading

This article synthesizes public product feedback and official documentation available as of March 6, 2026.

When OpenClaw Learned to Say 'No': How a Default Tools Change Turned an Agent into a Chatbot