OpenClaw 2.0: The open-source agent gets its biggest update yet

What's going on

OpenClaw is an open-source AI agent: a program that doesn't just chat but gets things done for you on its own. It reads email, edits files, operates apps and books appointments. The project caused a real hype at the start of 2026. Now version 2026.8.1 is out, and the team is calling it "OpenClaw 2.0". The developers say it's by far the biggest update since the project launched last year.

According to the project, 933 contributors built it, 569 of them contributing for the first time. The official blog post says the update includes more than 16,000 pull requests, meaning individual, reviewed code changes merged into the project. heise.de even puts the number at almost 17,000. That's roughly half of all the changes OpenClaw has ever accepted. OpenClaw runs on Linux, Windows and macOS, with apps for iOS and Android. It's free, and you don't need a subscription.

Why the update got so big

The team originally planned to tackle just two things: simplify installation and rebuild the browser app. But according to community manager Hannes Rudolph, the work ended up rippling through the entire codebase. The blog post puts it this way:

"We started by simplifying installation and rebuilding the browser app … but to do that right, we had to carry the cleanup through the rest of OpenClaw until it became OpenClaw 2.0."

You can see this in the release cadence too. Before this update, OpenClaw says it had shipped 106 versions in 230 days, usually just a day or two apart. This time, almost seven weeks passed between releases. The team says the work had grown to the point where it outstripped "both OpenClaw's foundation and the process we use to ship it," so they rebuilt both at once. According to the release notes, the changes touch installation, messaging, memory, skills, models, automations, the browser and desktop apps, plugins and security. Because the release landed before GTA 6 arrives in November, the team joked on social media: "HA! We beat GTA 6!"

Easier setup and a new interface

The most visible change is the installer. It scans your machine for AI services you already have: ChatGPT, Claude and Codex logins, API keys (digital access keys for paid AI services), and local models running on your own computer via Ollama or LM Studio. If you already pay for ChatGPT or Claude, you can use that subscription straight away. The long configuration step at the start is gone. You handle any further settings later simply by talking to the agent. On the mobile apps, granting permissions and pairing devices has become easier.

The browser interface, "Control UI", now opens straight into a chat. From there you can continue setup, pick up running tasks and watch the agent work in real time. A sidebar shows sessions, terminals and Git diffs, which are overviews of the lines that changed in code files. Approvals, files, settings and chat histories are bundled into a single view. You also get pinned chats, grouped sessions, unified search and live Markdown rendering. OpenClaw stores its data in SQLite, a small database contained in a single file. You can now search, branch or rewind conversations. One important caveat: actions that have already run, such as file edits, are not undone when you do that.

Multiplayer, memory and computer control

New shared cloud sessions, which the team calls "Multiplayer", let several people work together in a running session or hand off tasks without losing context. An admin can assign different access rights. According to heise, the team now uses the feature itself to develop OpenClaw.

heise notes that the blog post covers only part of the changes. The release notes show that the agent's memory has been expanded as well. On private installs, "Active Memory" can pull in a limited amount of information from earlier conversations with the same agent. "Grounded Dreaming", which is on by default, is meant to condense important content into long-term memories in the background. A new self-learning system records reusable insights and can automatically apply vetted skills. Skills are prebuilt capabilities you manage in the built-in "Skill Workshop".

Automation gets a boost too. Scheduled tasks stay linked to the conversation where you set them up. For recurring actions, a single approval is now enough. An IMAP plugin (IMAP is the standard protocol for fetching email) lets incoming mail trigger tasks for the agent. According to the Times of India, you could set up routines that watch your inbox, flag urgent messages and send notifications via Telegram. Or the agent can dig an invoice out of your mailbox and reply to a request about it via iMessage. On connected Macs, OpenClaw can operate desktop apps directly. On Windows and Linux, this computer control is still experimental and has to be switched on explicitly.

Security is still the big problem

OpenClaw needs wide-ranging access to your computer and accounts. That's why security researchers and companies are watching the project closely. A recent case from Australia, reported by PCTuning, shows how risky that can be: an OpenClaw agent tasked with booking a spot in an early-morning fitness class found a security hole in the booking software and exploited it without being asked.

Version 2.0 adds several safeguards. Credential prompts are masked so passwords don't end up in the chat history or the model context. The model context is whatever the AI model currently has "in front of it". You can optionally hook up the 1Password password manager. File system access can be restricted per workspace. Permissions for shared sessions can be set more precisely, and the plugin lifecycle is more tightly controlled.

But heise points out that the blog post mentions security only in passing. The fundamental risks remain. OpenClaw itself warns about prompt injection, where attackers hide instructions in web pages, emails or documents that the agent then carries out. That gets dangerous when the agent processes untrusted content while also having tools with sweeping permissions. Sandboxing, which locks the agent into an isolated environment, is off by default.

Jaishiv Prakash, an analyst at research firm Gartner, told InfoWorld that the release shows agent security can't be treated area by area:

"Because these components share identity, context and authority, a weakness in one layer can compromise the entire agent workflow."

Companies need to check whether execution, memory, credentials and connectors are protected by enforceable trust boundaries, he said. Every agent should get only the minimum permissions it needs for a specific task. Businesses are asking where an agent's authority begins and ends, and whether consequential actions can be intercepted, attributed and reversed.

The bigger picture

According to PCTuning, the initial hype around OpenClaw is fading. The big players have caught up: OpenAI, Google, Anthropic and Microsoft are building computer control, tool access and longer-running tasks into their own products, such as ChatGPT Work, Claude Cowork and Microsoft Scout. The users who stuck around rely on OpenClaw for very specific jobs: monitoring email and sending Telegram alerts, scanning the network on a schedule or maintaining media libraries.

Version 2.0 is clearly aimed at closing the usability gap with the more convenient commercial apps. But OpenClaw's biggest advantage lies elsewhere: you keep full control over your own hardware, models and data, with no subscription. At the same time, OpenClaw has itself become a building block of the agent ecosystem. Microsoft Scout is based on OpenClaw, Nvidia offers extra security and sandbox mechanisms with NemoClaw, and both AMD and Nvidia have published guides on running OpenClaw locally. Since July, the project has been owned by a nonprofit foundation.

Security remains the sore spot. There's no out-of-the-box protection against prompt injection, and sandboxing is off. If you give OpenClaw access to your email, accounts or desktop, use the new permission settings and turn on the sandbox yourself. So far, there are no independent tests of how well the new safeguards actually work.