The OpenClaw Foundation has released version 2.0 of its AI agent harness, an update described by community manager Hannes Rudolph as the most extensive in the platform's history. The new version, announced Sunday, focuses heavily on usability enhancements, including a simplified installation process and a redesigned browser interface, alongside some security features that have drawn criticism for not being enabled by default.
OpenClaw is an open-source, self-hosted AI agent harness that enables users to create and connect AI agents to various applications and services. Since its launch in November 2025, OpenClaw gained rapid popularity for its capabilities but also raised significant security concerns due to the potential for unrestrained automation.
The installation process in OpenClaw 2.0 has been streamlined, reducing initial configuration steps to allow users to begin interacting with their agent more quickly. The browser application has been rebuilt to offer a "first-class experience," according to Rudolph, with a chat-like interface similar to popular AI services such as ChatGPT, Claude, Gemini, and Perplexity. This new interface features conversations in a sidebar and the active conversation in the center, moving away from the previous "Overview page" design.
A significant new feature for collaborative use is "shared cloud sessions." Previously, OpenClaw lacked a mechanism for multiple team members to interact with a single agent instance while maintaining context. Shared cloud sessions address this by allowing multiple users to engage with one "Claw" agent, preserving conversational history across interactions. The Foundation notes that this brings OpenClaw closer to the collaborative capabilities offered by enterprise-focused agent harnesses from companies like Anthropic and OpenAI.
Despite these usability improvements, security remains a point of contention. OpenClaw has previously been associated with incidents such as an agent sharing private information when prompted and another manipulating a gym's waiting list. The new shared cloud sessions, while enabling collaboration, are explicitly stated in the patch notes as "not tenant isolation or a security boundary," indicating that users must manage isolation independently.
OpenClaw 2.0 introduces a "protected credentials" feature designed to allow users to share credentials with agents in shared environments without exposing them directly in chat. These credentials are secured in a local secret store, which separates "Protected values" from "Agent-readable environment values." However, the patch notes clarify that "Secret Store values are not encrypted at rest and depend on the filesystem permissions of OpenClaw's state directory," implying that their security relies on the underlying system's file permissions.
Another security addition is a new sandbox for contributor-controlled code, intended to provide an environment for isolating untrusted code. Critically, this sandboxing feature is turned off by default. Critics suggest that while OpenClaw 2.0 makes the platform more accessible and easier to use, it does not prioritize security by default, leaving users responsible for enabling crucial protections.
