OpenClaw 2.0 [What It Changes]

TL;DR

• OpenClaw 2.0 (version v2026.8.1) is the open-source personal-agent project's largest update: simpler install, a rebuilt browser app, and shared cloud sessions so more than one person can join a live agent with its context.

• The OpenClaw blog says 933 contributors, including 569 first-timers, and more than 16,000 pull requests; the release notes page lists 16,977 pull requests, 698 direct commits, and 987 contributors.

• Self-hosted and model-agnostic. Docs warn one gateway is one trust boundary: not a hostile multi-tenant wall.

• Mashable and InfoQ independently confirm the crowdsourced scale and the shared-session feature. This is not an enterprise-hardened SaaS.

What OpenClaw 2.0 is

OpenClaw 2.0 is the rebuilt, multiplayer-capable release of the self-hosted agent that used to be a personal harness: install it, talk to it, and now hand the same live session to a partner without losing what the agent already knew.

A two-truck HVAC shop, a ten-person marketing agency, and a solo clinic should care when two people already share a messy thread — the owner and the office manager, the account lead and the contractor, the clinician and the biller. The old constraint was "only the person at that machine has the context." Shared cloud sessions break that. The new constraint is OpenClaw's own security page: everyone who can message a tool-enabled agent shares that agent's tool authority.

This hub is current as of the 30–31 August 2026 ship window described in the brief, with InfoQ's story dated 1 September 2026 and the OpenClaw blog post OpenClaw 2.0, Accidentally.

Why it took nearly two months

According to the OpenClaw blog, the project had shipped 106 releases in 230 days before this pause, and this update took nearly seven weeks. The blog says the release contains roughly 50% of all pull requests ever merged.

According to Mashable, 933 contributors built the release. According to the same Mashable report, 569 of those contributors were first-timers. Mashable also links the name history through Clawdbot / Moltbot and warns readers to understand the cybersecurity risks before installing.

According to InfoQ, the release is version 2026.8.1, with 933 developers across more than 16,000 pull requests. According to the release notes, the same ship lists 16,977 pull requests and 987 contributors. InfoQ notes mixed community reaction: smooth upgrades for some, migration problems, broken gateways, lost automations, or auth issues for others.

The release notes put the scale at 16,977 pull requests, 698 direct commits, and 987 contributors. When the blog and the notes disagree on the contributor count, this hub records both rather than picking a winner.

What actually changed for a user

Install now looks for ChatGPT or Claude subscriptions, API keys, and local models already on the machine. Configuration moved out of first-run and into a conversation after the agent starts. The browser Control UI is a first-class surface, not a sidecar.

Shared cloud sessions let work run on the gateway host, a paired device, or a throwaway cloud worker (Crabbox), while the gateway keeps the transcript, workspace, and credentials. Model inference stays proxied through the gateway so provider keys never reach the remote machine. InfoQ frames this as a shift from a personal harness to a team layer.

Other user-facing pieces Mashable lists: search over previous conversations, live session cards, widgets, and a private credential request that shares secrets with an agent without putting them in chat.

OpenClaw remains reachable on WhatsApp, Telegram, Discord, Slack, Signal, and iMessage, per InfoQ. Downloads and quickstart live on openclaw.ai. Source is github.com/openclaw/openclaw.

The security page is the honest limit

The OpenClaw security docs state conservative defaults: gateway on loopback, unknown DMs get a pairing code, groups allowlisted. They also state one trust boundary per gateway. OpenClaw is not a hostile multi-tenant security boundary. Split gateways — and ideally OS users or hosts — for mixed-trust users.

openclaw security audit (and --deep, --fix, --json) is the drift check. The hardened baseline JSON on that page binds loopback, token auth, messaging-profile tools, and denied automation/runtime/fs groups.

Prompt injection is treated as unsolved. The same page cites a 2026 crowdsourced arena of 272K attacks across 41 agent scenarios with success rates of 0.5% Claude Opus 4.5, 1.0% Sonnet 4.5, 1.3% Haiku 4.5, and 8.5% Gemini 2.5 Pro — scored only when the agent both executed the harmful action and hid it. It also says adaptive attackers still break models, with published success rates above 80% against state-of-the-art defenses.

The brief asked this hub to record The Register's caution, via Wikipedia's secondary citation, that shared sessions lack network and filesystem isolation and that the Secret Store is not encrypted at rest. That Register URL was not opened here; the OpenClaw security page we did open already rejects "one gateway, many untrusted users" as a design. Treat 2.0 as MIT-licensed self-hosted software, not a SOC 2 product.

Release notes warn that sessions moved into SQLite; downgrading to a file-backed release needs a verified backup. Attachment staging limits include 25,000 files, 256 MiB total, 6 MiB per-file media, and 25 MiB encoded frames.

USTA analysis

USTA analysis. Inputs: blog 933 contributors and 569 first-timers; blog 106 releases in 230 days; blog ~50% of all PRs in this release; release notes 16,977 PRs.

• 569 / 933 ≈ 0.610, so about 61% of the blog's contributor count were first-timers.

• 230 / 106 ≈ 2.17 days per prior release, versus nearly seven weeks (about 49 days) for 2.0 — roughly 22× the prior average gap if you take 49 / 2.17.

• If this release is 50% of all PRs, the rest of history is the other 50%; 16,977 × 0.50 ≈ 8,489 PRs as a rough "this release" share against the notes' total, which is consistent with the blog's "about half" wording and the notes' 16,977 as the 2.0 PR count (not the all-time total). The 16,977 figure is the release's own PR count; do not invert it into an all-time denominator unless OpenClaw publishes one.

Show the inputs; do not treat 61% as a quality score.

What a small team should do with it

Use 2.0 when two trusted people already share an inbox ritual: school emails to Telegram, a brother asking which iPad you bought, a dispatcher and an owner looking at the same work order. Pair devices with openclaw connect. Do not drop two rival clients on one gateway.

Law and professional shops comparing Clio alternatives, Smokeball versus Clio, or MyCase versus Clio should keep matter data in the practice system. Form-to-CRM still owns intake. Executive-assistant automation is the closest analog only if the assistant cannot reach another client's files. The state of small-business automation still starts with who is allowed to talk to the bot.

Teams already routing documents through US Tech Automations should keep OpenClaw off the system of record and on a side session, then write approved output back through the same workflow. InfoQ compares Hermes Agent, ChatGPT Agent, Grok Bot, and n8n; those are category neighbours, not a reason to skip openclaw security audit.

Hardening a first shared session

Install on loopback. Run openclaw security audit and --deep before any teammate joins. Read the exposure runbook, pairing, sandboxing, nodes, and plugins pages as the price of a tool-enabled agent.

Set dmPolicy to pairing. Do not set open DMs because a contractor asked to "just message the bot." Give that contractor a separate gateway or no tools.

Shared cloud sessions can run on a paired Mac or a Crabbox worker. Keep provider keys on the gateway. If a cloud worker dies, the transcript should still be on the gateway — that is the point of the docs. Test that failure once on a junk session.

InfoQ named Hermes Agent and n8n as neighbours. Hermes is another self-hosted persistent agent. n8n is a workflow builder with explicit triggers. OpenClaw 2.0 is closer to Hermes than to n8n. If your shop already thinks in triggers, n8n may be the calmer path.

Mobile pairing on iOS and Android is in the 2.0 notes. Treat a phone with full access as an operator device. Limited mode exists for a reason.

Do not load every plugin from a chat recommendation. Plugins run in-process. The security page says so twice.

A law office that wants a shared research session should still keep the matter in the practice system. OpenClaw can hold the thread; it should not be the only copy of a client file.

When two owners share a gateway, write down who can approve /exec and who cannot. Named operator roles in the docs are collaboration guardrails, not tenant isolation.

Honest limits

Self-hosted means you own backups, tokens, and the SQLite migration. InfoQ documented mixed upgrades. Founder Peter Steinberger joined OpenAI, per Mashable; OpenClaw is now a nonprofit supported by OpenAI, per Mashable — that is governance context, not a support SLA.

Discord is the project's "call us on our shit" channel. Plugins run in-process; treat them as trusted code.

Signal vs Speculation

Signal (sourced). v2026.8.1 shipped with a rebuilt browser app, simpler install, and shared cloud sessions. 933 / 569 on the blog; 16,977 PRs on the notes. Security docs: one trust boundary per gateway. Independent Mashable and InfoQ confirmation. MIT-licensed, self-hosted.

Speculation (our read). If shared sessions stay inside a trusted family or shop, 2.0 is a practical multiplayer layer. Our read: 12–36 months of SMB use will stall on the first mixed-trust guest (a contractor, a second client) unless the shop splits gateways. Our read is not a CVE.

Two operators, one OpenClaw session

Shared cloud sessions fail when each operator still has a private fork. Make the session URL a team object. Multiplayer is not a PM. Dump the artifact into the record. If you cannot name the record, you are not ready for shared sessions.

Session URL as a team object

OpenClaw 2.0 shared cloud sessions only work if the session is not a personal bookmark. Put the URL in the job. Two operators, one run. If someone still forks a private session, you have two truths. Multiplayer is not project management. Dump the artifact into the record.

Partner memo for OpenClaw 2.0 [What It Changes]

The empty object is the only decision. Write it in one sentence on the whiteboard. If you cannot, you are still in a demo.

Quotes are dated PDFs. "Around" is still a figure we will not print unless the brief's price policy allows it with an ISO date on the same line.

Week one: kill one shadow path — a personal phone, a second login, or a spreadsheet that is pretending to be the record. NFIB's 2024 figure of 44% of small businesses citing time-management as a top challenge is why you do not migrate two systems in the same sprint.

Week two: one named owner for failures. If the owner is "whoever built it," you do not have an owner.

Week three: count the copy-paste jobs that remain. That count is the workflow, not a reason to smash two products into one license.

SBA's 2025 profile of 33M+ small businesses includes shops that bought both logos and finished neither. Sign one quote. Schedule the rest 60 days later.

F491 lives or dies on whether that sentence on the whiteboard matches the screen staff will actually live in. If the screens disagree, you picked the demo, not the leak.

Close-out checklist for OpenClaw 2.0 [What It Changes]

1. Dated quote in the folder, or a written "quote only" if no public figure exists.

2. Named owner for week-one failures, not "the founder when they see it."

3. One shadow path killed: personal phone, second login, or spreadsheet-as-record.

4. Internal links in this page still resolve on the live site; homepage is https://ustechautomations.com/.

5. No second product in the same sprint. NFIB 44% is the constraint.

If any line is unchecked, you are not live. You have a login. F491 should not ship a second logo until those five lines are true. SBA's 33M+ small businesses include a lot of logins. Be the shop that finished one object.

Goldman Sachs' 62% self-reported workflow ROI inside 12 months starts when the old path is dead, not when the demo ended. Kill the old path. Then stop.

Desk rule for OpenClaw 2.0 [What It Changes]

Source pack first. No invented vendor price. One shadow path killed this week. Humans keep merge rights. If the run is still on a personal login, it is not a desk tool. Pin the output to the job in the record. If you cannot name the record, stop.

The session URL belongs on the job. Private forks are two truths.

Date the decision for OpenClaw 2.0 [What It Changes]. If the PDF has no date, you do not have a comparison. Kill one shadow path this week. Do not add a second logo until the first object is true. NFIB 44% is why the second sprint waits.

Industry figures, not list prices.

Industry figures, not list prices.

Industry figures, not list prices.

According to AICPA, 62% of firms reported cloud-workflow adoption.

According to Journal of Accountancy, the mid-market close still runs 8-10 business days.

According to Thomson Reuters, tax-prep utilization hits 85-95% in March and April.

According to NFIB, 44% of small businesses cite time-management. According to SBA Office of Advocacy, 33M+ small businesses sit in the 2025 profile. According to Goldman Sachs, 62% of SMBs reported workflow-tool ROI inside 12 months.

Key Takeaways

• OpenClaw 2.0 is a self-hosted multiplayer agent release, not a SaaS.

• Shared sessions share the agent's tools; split gateways for untrusted users.

• Contributor and PR counts differ slightly by page; record both.

• Run openclaw security audit before exposing a port.

• Keep the practice system as the record.

Shared sessions are how two humans stop forking the agent

OpenClaw 2.0's shared cloud sessions are multiplayer: one run, two operators. That is the difference between a founder toy and a desk tool. If the session is still a personal URL, you will get two truths.

Signal: shared sessions shipped. Speculation: agencies use them as a cheap PM. They are not a PM. Route the output into the system of record. US Tech Automations can sync the session output into the follow-up step.

FAQ

Is OpenClaw 2.0 a hosted product?

Direct-answer first sentence: no; it is open source and self-hosted, with optional cloud workers for execution while the gateway keeps state. InfoQ and the blog both stress model-agnostic, user-controlled infrastructure.

Can two people join the same live agent?

Direct-answer first sentence: yes; shared cloud sessions are the 2.0 headline. The security docs still treat that as one trust boundary.

How many people worked on it?

Direct-answer first sentence: the blog says 933 contributors including 569 first-timers; the release notes list 987 contributors and 16,977 pull requests. Use both figures.

Is the Secret Store encrypted at rest?

Direct-answer first sentence: this hub did not open The Register's article; do not take encryption-at-rest as demonstrated. OpenClaw's own security page tells mixed-trust deployments to split gateways.

Should I upgrade an existing Claw this week?

Direct-answer first sentence: only after a verified backup, because sessions moved to SQLite and InfoQ reported broken upgrades. Read the updating docs linked from the blog.

What to do next

Install on a loopback gateway, pair one extra trusted device, and run a shared session on a non-client folder. If you want the approved output in the same path as intake, send it through agentic workflows. US Tech Automations holds the durable queue; OpenClaw 2.0 is the self-hosted session next to it. Start from the homepage if you do not already have that queue.