OpenClaw 2.0 eases setup, leaves key security opt-in

The OpenClaw Foundation shipped OpenClaw 2.0 on August 31, the largest update to the open-source, self-hosted AI agent harness since its late-2025 launch. OpenClaw's own release post credits 933 contributors and more than 16,000 merged pull requests, and describes a move away from the near-daily release cadence the project ran for its first eight months.

Three changes lead the release. Installation now starts from an existing ChatGPT or Claude subscription or a local model, with configuration handled during the first conversations instead of upfront. The browser app has been rebuilt as the primary interface, with sidebar conversations that resemble hosted chat products. And "shared cloud sessions" let several people work inside one agent instance while keeping context.

The release also adds security controls that were missing before. An agent can now request a secret through a masked prompt that is not written into chat history or model context, with optional 1Password brokering. Sessions carry explicit permission modes, filesystem access is pinned to a recorded workspace or worktree, and the plugin installer shows a plugin's capabilities, source, and version before install, with installs from arbitrary sources requiring a --force flag.

Those controls are opt-in, and some protections stay off. OpenClaw's documentation states that the shared-session controls "are not tenant isolation or a security boundary," and the sandbox for running untrusted code is disabled by default. The local secret store is not encrypted at rest and relies on filesystem permissions. Earlier public testing of OpenClaw showed agents disclosing private information when pressured and acting against outside systems, and 2.0 does not close that gap. It lowers the barrier to running an agent that can reach files, credentials, browser sessions, and messaging accounts, while leaving most of the hardening to whoever installs it.

Anyone adopting 2.0 with production credentials should turn on the new permission modes and credential prompts explicitly, enable the sandbox, and treat shared sessions as a collaboration convenience rather than a wall between users.