The OpenClaw team has released version 2.0, ending a seven-week silence after 106 releases over the prior 230 days. The update rewrites the installation process and rebuilds the browser Control UI. It moves sessions and transcripts into SQLite and adds shared cloud sessions.
Is it deployable?
Yes for single-operator and single-team deployments. No for multi-tenant products.
Setup starts from credentials you already have
Guided setup now looks for AI access already on the machine. It can reuse verified Codex, ChatGPT or Claude CLI sign-ins, accept an API key, run a provider sign-in, or find installed Ollama and LM Studio models. It then proves the exact choice can answer before saving that model and credential. Fresh OpenAI setups default to GPT-5.6. On the local side, node-llama-cpp was replaced with a managed llama-server, Gemma 4 became the RAM-gated llama.cpp default, and the llama.cpp default context was raised to 64K.
The browser app is now the primary surface
The rebuilt Control UI puts conversations at the center, with files, approvals and live work beside the chat. In a simulated default-chat test with a mocked Gateway and 50 ms HTTP/1.1 latency, JavaScript requests fell from 140 to 45 and startup fell from roughly 1.6 seconds to 575 ms.
Docked panels add a workspace file editor, a git-backed Changes panel with pull-request status and CI summaries, a browser panel with element inspection and screenshot annotation, and a full-screen web terminal. The limits are stated plainly: the file editor cannot create or delete files, Changes is read-only, and Create PR hands off to GitHub rather than submitting inside OpenClaw. Approval requests appear inside the conversation that triggered them, with a rolling 30-day history. A /btw command opens a side conversation so a quick question does not pollute the main transcript.
Storage moved to SQLite, and downgrades are not free
Sessions and transcripts now live in SQLite. Before rolling back to an older file-backed release, the current CLI must restore archived legacy transcript artifacts, and sessions created after the migration will not appear in older releases. Take a verified backup before upgrading.
Multiplayer, with an explicit ceiling
Shared cloud sessions let a second person join live work or take it over with context intact. Owners and administrators choose whether someone may read, suggest changes, work in a draft, or participate directly. The documentation is direct about the ceiling: these controls are not tenant isolation and not a security boundary. Incognito is off by default, keeps its conversation in process memory, and still sends messages to the model provider.
Security posture to review before rollout
The Gateway binds to loopback by default, and most chat channels answer an unknown DM sender with a pairing code. openclaw security audit checks inbound access, tool blast radius, network exposure, browser control exposure and plugin allowlists.
Model choice is treated as the first mitigation for prompt injection. OpenClaw cites a 2026 crowdsourced arena of 272K attacks across 41 agent scenarios, scored only when the agent both executed the harmful action and hid it from the user: 0.5% success against Claude Opus 4.5, 1.0% against Sonnet 4.5, 1.3% against Haiku 4.5, and 8.5% against Gemini 2.5 Pro. The same page warns that adaptive human attackers still exceed 80% success against state-of-the-art defenses, so tool policy, exec approvals and sandboxing remain the hard enforcement layer.
Interactive explainer
Key Takeaways
- v2026.8.1 lands 16,000+ PRs from 933 contributors, about half of OpenClaw’s total merge history.
- Guided setup reuses existing subscriptions, API keys and local models, and verifies the model before saving.
- Rebuilt Control UI cut test-harness startup from ~1.6 s to 575 ms and JS requests from 140 to 45.
- Shared cloud sessions add real multiplayer, but the docs say they are not a security boundary.
What it means
Developers and operators now have a faster interface that loads in under a second and lets them inspect code and chat history without leaving the browser. However, the new multiplayer feature is strictly for collaboration within a single team; it does not provide the security isolation required for multi-tenant SaaS environments.
