Sign in Subscribe
news

2026-10-03 OpenClaw 2.0 - easier setup, shared sessions, same security defaults

Sebastien Dubois

Sebastien Dubois

— 6 min read

Canonical version: 2026-10-03 OpenClaw 2.0 - easier setup, shared sessions, same security defaults.

On Sunday August 30, 2026, the OpenClaw Foundation released OpenClaw 2.0 (officially v2026.8.1). It's the largest OpenClaw release so far by a wide margin: the release notes count 16,977 pull requests, 698 direct commits and 987 contributors. That's roughly half of all the pull requests ever merged into the project, shipped in one go.

The announcement post is titled "OpenClaw 2.0, Accidentally". According to the post, the team never planned a 2.0.

Why "accidentally"

Hannes Rudolph, community manager at the OpenClaw Foundation, explains it in the post. The team wanted two things: a simpler installation, and a browser app rebuilt as a first-class experience. Doing that properly meant cleaning up everything those two depended on. The cleanup kept spreading through the codebase until it touched installation, messaging, memory, skills, models, automations, the native apps, plugins and security. At that point, they called it 2.0.

The release history shows the same thing. Before this update, OpenClaw had shipped 106 releases in 230 days, most of them a day or two apart. Then the main line went quiet for almost seven weeks (on GitHub, v2026.7.1 is dated July 13 and v2026.8.1 August 31, UTC). The team was growing fast, and the volume of work outgrew both the foundation of the code and the release process. So they reworked both at the same time, and took extra time to test fresh installs and upgrades of existing Claws.

What's in OpenClaw 2.0

The release notes split the changes into 15 areas. These are the ones that matter most to me:

  • A faster first run. Guided setup starts from what's already on your machine: a Codex, ChatGPT or Claude CLI sign-in, an API key, or local models in Ollama or LM Studio. It checks that the chosen model actually answers before saving it. A lot of configuration moved out of the initial setup, and you finish configuring your Claw by talking to it
  • A rebuilt web app. The Control UI now opens straight into a conversation, with your conversations in a sidebar (like ChatGPT or Claude). Files, approvals, settings and live work stay next to the conversation, and the sidebar can group conversations by project, person or custom groups
  • Shared cloud sessions ("multiplayer"). Several people can work in the same live session, with the agent's context intact. You can bring a colleague into running work or hand it over completely. Sessions can also run on a paired computer or a throwaway cloud worker (through Crabbox), while the Gateway keeps the transcript and the credentials
  • Memory across conversations. A personal Claw can now recall relevant context from the same agent's other private conversations. The built-in SQLite memory engine owns search and recall, and the QMD backend is retired (openclaw doctor --fix migrates it)
  • Sessions and transcripts in SQLite. They used to be plain files. Sessions created after the migration won't show up if you downgrade
  • Skills, end to end. Creating, validating, finding, installing and calling skills now follow one path, and Skill Workshop keeps proposals, checks, decisions and history in one place
  • Cron is now called Automations. The new name is used everywhere, but openclaw cron, existing jobs and schedule expressions keep working
  • Browser and Computer Use. Signed-in browsing through an isolated managed browser profile or the Chrome tabs you explicitly share. Computer Use works on paired Macs and on Windows machines where you enable it; Linux is still experimental
  • Plugins from the UI. Admins can browse, install, enable and remove plugins from the Control UI, along with curated ClawHub skills and vetted MCP connectors
  • Tighter approvals and secrets. An approval stays tied to the exact request, command, session and person that received it. Protected credentials can reach supported destinations without ever showing up in text the model can see
  • Native apps. iPhone, iPad, Android, macOS (Quick Chat from the menu bar) and Wear OS all get more of the conversation controls

A package published as 2026.9.1-beta.1 was mislabeled. It's actually 2026.8.1-beta.4, and it's NOT newer than the stable 2.0.

The team built 2.0 with 2.0

On August 31, Peter Steinberger wrote on X that two months earlier the team had started a mission to "build OpenClaw with OpenClaw". Bit by bit, they moved everyone off their local coding harness and onto a shared team agent that knows what everyone is working on. His conclusion: local harnesses "feel like relics of the past now".

The multiplayer sessions came out of that internal use: the team needed them first.

How people reacted

On Hacker News, the reaction was cool (148 points, 175 comments):

  • The top thread asked who still uses OpenClaw at all, pointing at Google Trends: interest peaked around March and dropped sharply after. Several commenters said they had moved to Hermes Agent, NanoClaw or smaller harnesses
  • Security was the other big theme. Several commenters see an agent with access to your email, accounts and shell as an open door for prompt injection, and the "lethal trifecta" came up more than once
  • The "569 first-time contributors" figure from the announcement was read by quite a few people as a code quality warning rather than a strength
  • Existing users complained that updates regularly break their setup, and some found the docs too intimidating to even start
  • On the positive side, some people described concrete daily uses (school emails, home lab management, job hunting), and a few liked the idea of a shared space where a family or team works with the agent

The press focused on security too. According to The Register, 2.0 makes OpenClaw much easier to get running, but it doesn't bring security by default with it. The release notes themselves say shared session controls are not tenant isolation or a security boundary, Secret Store values aren't encrypted at rest, and sandboxing is off by default.

VentureBeat saw 2.0 as OpenClaw moving from personal agent to team and enterprise infrastructure. According to VentureBeat, OpenClaw can now be hardened to something close to NanoClaw's container model (Docker or Podman sandboxes, role-enforced sandboxing, cloud workers), but you have to configure that deliberately. And one Gateway is a single trust domain; for real separation, OpenClaw recommends separate Gateways (it calls them "cells"). A startup CEO quoted in the article described how, when a teammate took over his project, the shared session itself was the handoff document.

What happened next

In a September 18 post on its blog, OpenClaw admits that the update problems around the 2.0 launch were widespread, and explains the move to atomic updates: a failed update should leave the previous version running instead of taking the whole Claw down. The stable line has moved fast since then, from 2026.8.2 (September 1) to 2026.9.8 (October 3).

Two other announcements followed within a month. On September 25, OpenClaw explained that Microsoft's new Autopilot agent is built on OpenClaw, with Microsoft contributing work back upstream. And on September 29, the Foundation announced OpenClaw Enterprise, an open source control plane with multi-tenancy and hard security boundaries. Those are the features critics said 2.0 lacked; it's in pilot mode, with 1.0 planned later this year.

My take

I like the direction. Starting setup from the subscriptions and local models you already have removes the most painful step, and a chat-first web app is what non-developers expect. Shared sessions are the most interesting idea in the release: the agent's context becomes something a team can share and hand over, instead of being locked in one person's chat history.

But the critics are right about the defaults. 2.0 makes OpenClaw easier to install for exactly the people who are least equipped to judge what they're giving it access to, and the sandbox still isn't on out of the box. Until OpenClaw Enterprise reaches 1.0, treat one Gateway as one trust zone.

If you run OpenClaw:

  • Create a verified backup before you upgrade. Sessions move to SQLite, and going back to an older version means restoring archived transcripts with the current CLI first
  • If you used QMD as the memory backend, run openclaw doctor --fix. QMD-only features (reranking, query expansion, cross-agent transcript search) are gone
  • Turn sandboxing on (Docker or Podman) if your Claw can touch anything you care about
  • Run separate Gateways for people you don't fully trust

I've updated my OpenClaw and OpenClaw Memory System notes with the 2.0 changes.

That's it for today! ✨

References

About Sébastien

Ready to get to the next level?

Found this valuable? Share it with someone who needs it.

Join 6,000+ readers. Get practical systems for knowledge & AI. Free.

Subscribe ✨

Free: Knowledge System Checklist

A clear roadmap to building your own knowledge system. Subscribe and get it straight to your inbox.

6,000+ readers. No spam. Unsubscribe anytime.

Subscribe