OpenClaw 2.0 Release

OpenClaw broke its own rhythm to build this release. The project had shipped 106 versions in 230 days before quietly going dark for close to seven weeks - an eternity by its standards - because, in its own words, the growing codebase needed a stronger technical foundation and a safer upgrade path ^[1]. What came out the other side is the largest release in OpenClaw's history: more than 16,000 merged pull requests from 933 contributors, including 569 people submitting a PR for the first time, together accounting for roughly half of every pull request ever merged into the project ^[2].

The most visible payoff is speed, not features. The browser-based Control UI was rebuilt around a chat-first layout that tucks sessions into a sidebar next to files, approvals, terminals, and git diffs, cutting JavaScript requests from 140 to 45 and shrinking startup time from about 1.6 seconds to 575 milliseconds ^[3]. Installation got a parallel simplification: a guided setup now scans the machine for AI access a user already has - verified Codex, ChatGPT, or Claude CLI logins, existing API keys, or locally installed Ollama and LM Studio models - so most configuration never has to happen on first run ^[3]. Paired with a genuine architecture change underneath, moving session and transcript storage from flat JSONL files into SQLite ^[1], this reads less like a feature drop and more like the rebuild a fast-growing open-source project eventually has to do to keep scaling.

Read past the changelog and OpenClaw's own paperwork undercuts some of the confidence around this release. The 2.0 security additions are real: credential requests are now masked so secrets never land in chat history, there is an optional 1Password broker, plugins display their provenance before install, and one-time approvals expire the moment an automation's behavior changes ^[3]. But the documentation itself draws a hard line under all of it, stating plainly that these controls are not tenant isolation and not a security boundary ^[3].

Outside critics have been blunter. The Register argues OpenClaw 2.0 prioritized polish over fixing structural gaps, pointing out that its Secret Store still is not encrypted at rest and depends on filesystem permissions, that shared sessions are not a tenant-isolation boundary, and that the new sandbox for running untrusted code ships turned off by default ^[4]. Randolph Barr, CISO at Cequence Security, put the imbalance in one line: product usefulness improved faster than security ^[5]. For a tool that routinely runs with broad file, credential, and system access on a user's own machine, a permissions model that admits it isn't a boundary is a meaningful asterisk on an otherwise well-received release.

For anyone already running OpenClaw, 2.0 is less of a free upgrade than it looks. Moving sessions and transcripts into SQLite is effectively a one-way door: rolling back to an older, file-backed release means manually restoring archived legacy transcript artifacts through the current CLI, and any session created after migrating simply will not exist as far as the older build is concerned ^[6]. That is a meaningfully higher-stakes decision than a typical point release, and it lands squarely on users who treat OpenClaw as production infrastructure rather than a weekend project.

Early adopters are finding the practical cost of that migration firsthand. Community reports describe automations getting wiped or fragmented after updating, a default worker-concurrency change from a hardcoded value of two down to one worker per CPU core causing unexpected slowdowns, and third-party plugins for WhatsApp, Discord, and Codex breaking against the new SDK. Not everyone agrees the release itself is to blame - some point to heavy customization rather than a lack of testing - but the volume of people needing multiple repair passes to clear legacy configuration suggests the migration story is rougher in practice than the release notes let on.

The headline new capability - shared cloud sessions that let multiple people work inside a single agent's context with an admin controlling read-only, suggest, draft, or full-participation access - is aimed squarely at enterprise workflows where several people already touch the same automation ^[7]. It is also, unavoidably, a catch-up move: the feature gives OpenClaw rough parity with the collaborative agent harnesses that Anthropic and OpenAI already offer their own enterprise customers ^[7].

That competitive framing gets stranger considering who is funding OpenClaw today. Creator Peter Steinberger joined OpenAI in February 2026, and Sam Altman publicly pledged that OpenClaw would keep living inside an independent foundation as an open-source project that OpenAI itself helps fund ^[8]. On X, Steinberger described the timeline in his own words: two months ago the team began "building OpenClaw with OpenClaw," gradually moving everyone off individual local coding harnesses and onto team.openclaw.ai, a shared agent that knows what everyone is working on and orchestrates it - what he called multiplayer coding, in a post that resonated widely with developers. An OpenAI-backed open-source project building session-sharing infrastructure that competes with OpenAI's own enterprise offering is an odd position for all sides, and it is not yet clear how that tension resolves.

OpenClaw 2.0's security additions land against a backdrop the release itself cannot fix: the health of everything built around OpenClaw. Snyk's ToxicSkills audit scanned nearly 4,000 skills listed on ClawHub and skills.sh and found 36.82% carried at least one security flaw, 13.4% had a critical-level issue, and 76 confirmed malicious payloads built for credential theft, backdoors, and data exfiltration - eight of which were still publicly listed at time of publication ^[9]. None of that lives inside the OpenClaw core codebase this release touched; it lives in the marketplace of third-party skills that OpenClaw's plugin provenance display is meant to help users evaluate, not eliminate.

A separate incident from the same window shows the exposure isn't limited to skills either. NVIDIA's NemoClaw, a companion deployment wrapper, shipped with its local Ollama server listening unauthenticated on the network, letting a single malicious webpage use DNS rebinding to reach it and poison the model's chat template - a high-severity flaw (CVSS 8.1) that NVIDIA patched on August 25, 2026, five days before OpenClaw 2.0 shipped ^[10]. Taken together, the skills marketplace numbers and the NemoClaw patch describe an ecosystem where the attack surface has grown faster than any single release, including this one, can secure it.