OpenClaw 2.0 ships multiplayer agents and enterprise security controls
OpenClaw, the open source AI agent harness that lets users interact with language models through Telegram, iMessage, WhatsApp, Discord, and other messaging channels, shipped version 2.0 over the weekend. The update is officially tagged v2026.8.1 and covers installation, messaging, memory, skills, models, automations, browser and native apps, plugins, and security.
The release was built using OpenClaw itself. Creator Peter Steinberger, who joined OpenAI on February 14, 2026, wrote on X that the team spent two months moving from individual local harnesses to team.openclaw.ai, a shared agent environment. He described local harnesses as now feeling like “relics of the past.” OpenClaw is stewarded by the independent OpenClaw Foundation, a 501(c)(3), with OpenAI listed as a partner alongside Microsoft, GitHub, NVIDIA, Atlassian, and Tencent. This is an OpenClaw Foundation release, not an OpenAI product.
What Is New in 2.0
The biggest structural shift is the move from a personal agent tool toward shared team infrastructure. The redesigned Control UI puts conversations at the center, with threads in a sidebar and files, approvals, settings, and live agent activity accessible around the main workspace. The design deliberately echoes ChatGPT, Claude, and Gemini to lower the adoption barrier for non-engineering employees.
Shared cloud sessions let a second employee enter a session already in progress without losing the context the agent has accumulated. Multi-user Gateways track who created a conversation and which prompts came from which participant. Owners and administrators can set whether another user can read a session, suggest changes, draft, or participate directly. Session ownership, participant attribution, presence indicators, and typing indicators are all new.
Colin Johnson, CEO of marketing metrics firm Solvely, described the practical effect in a post on X. His team already ran OpenClaw agents through Discord for task assignment and development environment interaction, but that still felt like messaging a bot. The multiplayer WebUI changed it: two developers could open the same live session, see the same history and artifacts, and add to it without reconstructing prior context. In one case, instead of writing a handoff document for a developer taking over a project, Johnson joined the developer’s existing agent thread and added context directly. As he put it, “the session itself became the handoff document.”
Security Controls Added
The security model received a significant expansion. Approvals can now be tied to a specific request, command, session, and person. Command permissions can be constrained to specific arguments and working directories. Sessions can run under read-only, guarded, workspace, or full-access modes, with the highest level restricted to administrators. Organizations can define operator roles that require sandboxed execution; OpenClaw says those requirements cannot be bypassed, and if the required sandbox cannot be provisioned, execution fails rather than silently falling back to the host.
The team-scoped Secret Store separates protected secrets from ordinary environment data. For supported requests, a protected credential can be substituted into a Gateway-hosted HTTPS request without exposing it to the model directly. OpenClaw can also reference 1Password and Vault. Auditing now covers execution identity, approvals, session actions, and outbound messages.
⚠️ What Enterprises Still Need to Configure
OpenClaw’s own documentation states that sandboxing and execution approvals are off by default. The baseline configuration assumes a trusted single operator and permits host execution unless administrators explicitly configure otherwise. An enterprise can harden OpenClaw substantially, but it has to choose to do that.
The comparison with NanoClaw, the container-first alternative that puts OS-level isolation at the center of its architecture, remains relevant here. NanoClaw runs agents inside Docker containers, limits them to explicitly mounted filesystems, runs processes as an unprivileged user, and routes supported outbound traffic through a gateway rather than the container itself. OpenClaw 2.0 now supports Docker and Podman sandboxes, per-agent and per-session sandbox scopes, and remote execution nodes, making the capability gap narrower. But the philosophical difference in defaults remains.
OpenClaw also notes that a single Gateway should be treated as a single trust domain. Multi-user permissions govern collaboration among trusted users; they are not hard isolation between untrusted tenants. Organizations needing stronger separation between business units or customers should run separate Gateway instances, referred to as cells. Fleet tooling for managing those cells is described as experimental.
One additional caveat from the documentation: Secret Store values are not encrypted at rest and rely on filesystem protections. Protected credential substitution does not cover every execution path, including some raw sockets, containers, remote nodes, and provider-native harnesses.
Release Scale
The release involved 933 contributors, including 569 first-time contributors, and more than 16,000 pull requests, which the project says is roughly half of all pull requests ever merged into OpenClaw.
For teams already running OpenClaw locally, the 2.0 update is the clearest path yet to turning individual agent sessions into shared team infrastructure. The security controls are real, but enterprises should treat them as a starting point for configuration rather than a default guarantee.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
