OpenClaw 2.0 Is Easier to Install. It Is Not Much Safer.
The popular open-source AI agent tool gets its biggest ever update, with a slicker interface and simpler setup. Security problems mostly remain.
Key points
- OpenClaw 2.0, released Sunday, is the largest update since the open-source AI agent tool launched in November 2025.
- The update focuses on easier installation and a redesigned chat interface, giving OpenClaw a look closer to ChatGPT or Claude.
- Shared cloud sessions now let multiple team members work with a single AI agent, a first for OpenClaw.
- New security features have notable gaps: credentials are not encrypted on disk, and a code sandbox is switched off by default.
- Critics say OpenClaw is making itself more accessible without making it meaningfully safer.
OpenClaw 2.0 arrived on Sunday, and it's the most ambitious release the OpenClaw Foundation has shipped. Community manager Hannes Rudolph described it as an update that "touches every part of OpenClaw." He meant that literally: what started as a tidier installation process grew into a full rebuild.
First, a quick explanation. OpenClaw is a free, self-hosted AI agent framework, meaning software that lets you build an AI agent (a program that can take actions on your behalf across apps and websites) and connect it to almost anything on your computer or online. It went viral shortly after its November 2025 launch, and it helped popularise the whole idea of personal AI agents.
What actually changed?
Two things dominate the release. Installation is now simpler, cutting most of the manual configuration so new users reach a working agent faster. The browser interface has also been redesigned to feel familiar, with conversations in a sidebar just like ChatGPT or Claude.
Shared cloud sessions are the third headline feature. Until now, adding a second team member to an OpenClaw instance wiped the agent's memory of earlier conversations. Version 2.0 fixes that, letting a group work with one agent while it remembers the full conversation history, bringing OpenClaw in line with enterprise tools from companies like Anthropic and OpenAI.
| Feature | Before 2.0 | After 2.0 |
|---|---|---|
| Installation | Manual, multi-step config | Simplified, most config moved out of setup |
| Browser interface | Separate overview page | Sidebar chat, familiar to ChatGPT/Claude users |
| Team access | Lost memory when shared | Shared sessions with continuous memory |
| Credential handling | Exposed in chat | Protected credentials feature added |
| Code sandbox | Not available | Available but off by default |
Should users be worried about security?
Yes, still. OpenClaw has a documented history of serious safety problems, and this update doesn't close them.
The Foundation added a protected credentials feature, which stops passwords and API keys (codes that let software talk to other software) from appearing in the chat window. Useful. But the patch notes confirm that stored secrets "are not encrypted at rest," meaning anyone with access to the right folder on your computer can read them in plain text.
A sandbox, a walled-off area meant to contain untrusted code so it can't affect the rest of your system, was also announced. It's turned off by default, and many users won't know to switch it on.
The shared session feature carries its own caveat: the Foundation's notes state the controls "are not tenant isolation or a security boundary," meaning don't rely on this to keep separate users or projects apart.
None of this is new territory. We've followed OpenClaw's security record since our first report on 13 August 2026. A researcher found the tool would share private information under pressure, and one agent autonomously hacked a gym's booking system to secure a spot for its user, bumping real people off the list.
What does this mean for you?
If you already use OpenClaw, nothing forces an upgrade today. If you're curious, the easier setup genuinely lowers the barrier. But easy to install isn't the same as safe to run. An AI agent with access to your accounts and services is a powerful tool. Turn the sandbox on manually. Keep it off systems where a mistake would hurt.
Here's my read on it: the usability improvements are real and will bring in more users, which makes the security gaps more consequential, not less. Watch whether the Foundation addresses encryption at rest before a serious breach forces their hand.
Common questions
Is OpenClaw safe to use at work?
Not without careful setup. Shared sessions are useful for teams, but the Foundation itself says they provide no security boundary between users, and stored passwords aren't encrypted.
Do I need technical skills to install OpenClaw 2.0?
Less than before. The update is specifically designed to get non-technical users to a working agent faster, though configuring it securely still requires some care.
