OpenClaw 2.0 release

OpenClaw 2.0 didn't start as a plan to rewrite the project; per the project's own post-mortem, 'OpenClaw 2.0, Accidentally,' it grew into the largest update in the project's history almost by accumulation, eventually touching installation, messaging, memory, skills, models, automations, the browser and native apps, plugins, and security all at once ^[1]. That scope makes sense given who built it: 933 contributors, including 569 first-time contributors, merged more than 16,000 pull requests into the release ^[2]. Chief Architect Vincent Koc has said the release represents roughly 50% of all pull requests merged into OpenClaw since the project's inception, and that the team built OpenClaw 2.0 using OpenClaw itself, running on local model inference ^[2]. The cost of that scope creep shows up in cadence too: a project that had shipped 106 releases in the prior 230 days went quiet for about seven weeks before 2.0 landed ^[2].

The headline feature is what OpenClaw calls shared cloud sessions: multiple people can join a single running agent session, retain its full context, and hand a task off between users, turning agent work into something closer to multiplayer collaboration than a solo assistant ^[3]. Founder Peter Steinberger frames this as a genuine leap, describing the shift from individual, local coding harnesses to shared, cloud-based multiplayer sessions as a major change in how people use agents to build software ^[3]. Solvely CEO Colin Johnson, an enterprise user, has pointed to concrete benefits from shared-session workflows in practice ^[3]. The asterisk is that this collaboration layer is explicitly not a security boundary: OpenClaw's own documentation states that shared-session controls do not provide tenant isolation, meaning the multiplayer convenience and the trust model are two separate questions ^[4].

OpenClaw 2.0's security additions are real: stronger Docker- or Podman-based sandboxing, role-based permissions, request-specific approvals, command permissions scoped to arguments, a protected credentials Secret Store, plugin provenance checks, and a new 'openclaw security audit' command ^[4][5]. The release also reports strong results in a prompt-injection test arena, succeeding against attacks only 0.5% of the time when matched against Claude Opus 4.5 and 8.5% of the time against Gemini 2.5 Pro ^[4]. But The Register's analysis argues the update improves usability without fixing the underlying default-insecure posture: sandboxing and execution approvals remain opt-in rather than on by default, and the Secret Store's values are not encrypted at rest, relying instead on filesystem permissions for protection ^[5]. That gap matters against a documented track record - security researchers have logged 10 CVEs against OpenClaw in the six months before this release, and Snyk found more than 7% of skills in ClawHub, OpenClaw's marketplace, contained flaws that exposed sensitive credentials ^[5]. Gartner director analyst Jaishiv Prakash frames the stakes for enterprises: agent security has to be addressed holistically across runtime, memory, and integrations, with enforceable trust boundaries and identity and data isolation in place before organizations adopt agent platforms like OpenClaw at scale ^[6].

Much of the public reaction has focused less on the feature list and more on how the upgrade actually feels. On Reddit, r/openclaw discussion split between praise for the new Control UI and detailed, technical complaints specifically about upgrading an existing install rather than doing a clean one - users described repair scripts needing multiple passes, broken gateways, and wiped automations, and the community's emerging consensus is to do a clean install and back up first rather than upgrade in place. On X, the official announcement drew broad, largely celebratory reach, but a vocal critical minority pushed back hard on the polish of the release, arguing the setup experience fell short given the project's resources and backing, a critique that reportedly drew a defense from an OpenClaw team member. YouTube creators, meanwhile, framed 2.0 less as an incremental patch and more as a direction shift, describing OpenClaw moving from a smart assistant to a persistent agent with memory, a real workspace, and the ability to work together with other people and other agents, alongside the vendor's own framing that one agent setup equals one trust zone for shared sessions. Together, the upgrade friction and the multiplayer ambition read as two sides of the same fast-moving release.