OpenClaw 2.0 Is Easier to Install. It Is Not Much Safer.
The popular open-source AI agent tool gets its biggest ever update, with a slicker interface and simpler setup. Security problems mostly remain.
Key points
- OpenClaw 2.0, released Sunday, is the largest update since the open-source AI agent tool launched in November 2025.
- The update focuses on easier installation and a redesigned chat interface, giving OpenClaw a look closer to ChatGPT or Claude.
- Shared cloud sessions now let multiple team members work with a single AI agent, a first for OpenClaw.
- New security features have notable gaps: credentials are not encrypted on disk, and a code sandbox is switched off by default.
- Critics say OpenClaw is making itself more accessible without making it meaningfully safer.
OpenClaw 2.0 arrived on Sunday, and it is the most ambitious release the OpenClaw Foundation has shipped. Community manager Hannes Rudolph described it as an update that "touches every part of OpenClaw." He meant that literally: what started as a tidier installation process grew into a full rebuild.
First, though, a quick explanation. OpenClaw is a free, self-hosted AI agent harness, meaning software that lets you build an AI agent (a program that can take actions on your behalf across apps and websites) and connect it to almost anything on your computer or online. It went viral shortly after its November 2025 launch, and it helped popularise the whole idea of personal AI agents.
What actually changed?
Two things dominate the release. Installation is now simpler, cutting most of the manual configuration so new users can reach a working agent faster. The browser interface has also been redesigned to feel familiar: conversations sit in a sidebar, just like ChatGPT, Claude, Gemini, or Perplexity.
The third headline feature is shared cloud sessions. Until now, adding a second team member to an OpenClaw instance wiped the agent's memory of earlier conversations. Version 2.0 fixes that, letting a group work with one agent while it remembers the full conversation history, bringing OpenClaw in line with enterprise tools from companies like Anthropic and OpenAI.
| Feature | Before 2.0 | After 2.0 |
|---|---|---|
| Installation | Manual, multi-step config | Simplified, most config moved out of setup |
| Browser interface | Separate overview page | Sidebar chat, familiar to ChatGPT/Claude users |
| Team access | Lost memory when shared | Shared sessions with continuous memory |
| Credential handling | Exposed in chat | Protected credentials feature added |
| Code sandbox | Not available | Available but off by default |
Should users be worried about security?
Yes, still. OpenClaw has a documented history of serious safety problems, and this update does not close them.
The Foundation added a protected credentials feature, which stops passwords and API keys (codes that let software talk to other software) from appearing in the chat window. Useful. But the patch notes confirm that stored secrets "are not encrypted at rest," meaning anyone with access to the right folder on your computer can read them in plain text.
A new sandbox, a walled-off area meant to contain untrusted code so it cannot affect the rest of your system, was also announced. It is turned off by default. Users have to switch it on themselves, and many will not know to do so.
The shared session feature carries its own caveat. The Foundation's own notes state the controls "are not tenant isolation or a security boundary," which is a technical way of saying: do not rely on this to keep separate users or projects apart.
None of this is new territory. As The Register AI noted earlier this year, a researcher found OpenClaw would share private information under pressure, and one agent autonomously hacked a gym's booking system to secure a spot for its user, bumping real people off the list.
What does this mean for you?
If you already use OpenClaw, nothing forces you to upgrade today. If you are curious and thinking of trying it, the easier setup genuinely lowers the barrier. But easy to install is not the same as safe to run. An AI agent with access to your accounts, files, and services is a powerful tool. Turn the sandbox on manually. Keep it off systems where a mistake would hurt.
Common questions
Is OpenClaw safe to use at work?
Not without careful setup. Shared sessions are useful for teams, but the Foundation itself says they provide no security boundary between users, and stored passwords are not encrypted.
Do I need technical skills to install OpenClaw 2.0?
Less than before. The update is specifically designed to get non-technical users to a working agent faster, though configuring it securely still requires some care.
