OpenClaw 2.0 Launches with Simplified Install, Revamped UI, and User‑Controlled Security

OpenClaw Foundation announced the release of OpenClaw 2.0, describing it as the largest update to their open‑source, self‑hosted AI agent framework. Community manager Hannes Rudolph said the update focuses on simplifying the installation process and rebuilding the browser application into a first‑class user experience, which required extensive cleanup of other components.

The new installer removes many configuration steps and moves remaining settings out of the initial setup, allowing users to start a conversation with a Claw instance more quickly. The browser UI has been redesigned to resemble familiar chat interfaces used by services such as ChatGPT, Claude, Gemini, or Perplexity, with the active conversation shown in the center and a sidebar for other dialogs.

A major functional addition is shared cloud sessions, enabling multiple team members to interact with a single Claw instance while preserving context. The patch notes clarify that shared sessions do not provide tenant isolation or a security boundary, so users must ensure they do not need to separate different instances.

Security‑related enhancements include a protected‑credential feature that stores shared secrets in a local keystore, separating them from values readable by support staff. However, the keystore stores static secret values unencrypted and relies on filesystem permissions of the OpenClaw state directory.

The release also introduces a sandbox intended to isolate untrusted contributor code. While the sandbox sounds promising, it is disabled by default, limiting its immediate protective effect.

Historical security concerns are highlighted: since its November 2025 launch, OpenClaw has been criticized for leaking private information and enabling malicious actions, such as an agent hijacking a gym’s waitlist. These incidents underscore the need for thorough testing and cautious deployment of powerful, potentially dangerous tools.

Overall, OpenClaw 2.0 makes the framework easier to install and use, but the default security posture has not been substantially strengthened, and users must actively configure safeguards like credential protection and sandboxing.