OpenClaw announced version 2026.8.1 as OpenClaw 2.0 on August 30, 2026, and published the final GitHub release on August 31, 2026. The project describes this as its largest update so far, built from more than 16,000 pull requests by 933 contributors, including 569 first-time contributors. Those figures come from the project’s official release announcement, so they indicate the scale of the development effort rather than independently measured product quality.
The practical change is broader than a new interface. OpenClaw 2.0 revises first-run setup, the browser application, conversation retrieval, remote session placement, team participation, credential handling, recurring automation approvals and the update path. Existing operators should treat it as a significant platform migration, not a routine patch.
Setup now starts with the model access you already have
OpenClaw says its guided setup can begin with an existing ChatGPT or Claude subscription, an API key, or a local model already available on the machine. The intention is to reduce the amount of provider configuration required before the first conversation. It does not mean every model is bundled or that one account type grants access to every provider route.
The final 2026.8.1 release notes also describe guided onboarding cards, local-model download actions, live provider discovery and agent-specific provider accounts. Several providers now ship as separately installed official packages, so operators upgrading an existing gateway should verify that every configured provider package remains present and enabled.
- Subscription-backed setup can reuse supported account access.
- API-key setup remains available for direct provider authentication.
- Local inference can use managed llama.cpp models or an existing llama-server.
- Provider packages may require explicit installation, capability review and a Gateway restart.
The browser app becomes the main operating surface
The rebuilt browser application opens around the active conversation rather than treating chat as one small part of a settings console. OpenClaw’s current Control UI documentation describes conversation, session, automation, task, workboard, plugin, skill, browser and terminal controls inside the same web workspace.
Conversation search can match exact words or phrases in visible transcript text and reopen the surrounding messages. Durable progress cards retain the latest plan or status through reloads across web and native clients. That is useful for long-running work because an operator can leave the page and return without relying only on the final answer to understand what happened.
The release also adds structured question cards, editable prompt queues, interactive widgets and dashboards. These are interface and workflow capabilities. They do not establish that an agent will complete a task correctly, and operators still need to inspect outputs and consequential actions.
Sessions can move beyond one Gateway machine
OpenClaw 2.0 can place work on paired devices or provisioned cloud workers while the Gateway retains the canonical conversation, provider credentials, placement history and reconciled workspace. The cloud-session documentation says model credentials remain with the Gateway rather than being copied to the remote execution machine.
Operators can move eligible sessions between destinations, reuse prepared project seeds and suspend idle cloud workers. Shared-session controls can assign an owner and decide who may view, suggest or contribute. Creator attribution and user presence help teams understand who is participating in a session.
These capabilities create a collaboration layer around agent work. They also enlarge the operational surface: remote hosts, workspace reconciliation, attachment transfer, cloud lifecycle and user access all require configuration and monitoring. A disconnected paired device can retain active placement, while unreconciled file changes remain a possible loss window until the workspace is synchronized.
Credential requests and recurring approvals are more narrowly scoped
A new private credential-request flow lets an agent ask for a value through a masked prompt without placing the value in ordinary chat text or model context. An optional protected proxy can restrict secret substitution to approved destinations. The release also adds a shared credential store whose secret values are write-only in ordinary management surfaces and whose protected egress can be bound to declared hosts.
This is a more deliberate path for supplying secrets, but it is not a universal guarantee that credentials can never reach a model or process. Operators must still review the exact tool, plugin, destination and execution policy involved. For example, the release notes state that an explicitly approved agent-tool read through the optional 1Password broker exposes the selected value to the model for that execution.
Recurring automation permissions receive a similar scope check. An operator can approve one exact operation, inspect or revoke that grant later, and require a fresh approval when the job or operation changes. The useful security property is the bounded operation, not the word “automation.” Broadly worded jobs still deserve close review.
Team roles are not hostile-tenant isolation
OpenClaw 2.0 introduces named team operator roles that can restrict accessible agents, other people’s sessions and operator scopes. Administrators can also require sandboxed execution for newly created sessions.
The project explicitly states that these roles are collaboration controls, not isolation for mutually hostile tenants. A role assignment should therefore not be treated as a substitute for separate infrastructure, operating-system boundaries or another security architecture when users do not trust one another. The same caution applies to shared credentials and session workspaces on a common Gateway.
A practical upgrade checklist
The release includes breaking migrations and changes to provider packaging. OpenClaw’s official update guide recommends creating a verified recovery point before a significant update because the automatic pre-update configuration copy is not a complete state backup.
- Create and verify a full backup with
openclaw backup create --output --verify. Protect the archive because it can contain credentials, authentication profiles and channel state. - Read the final release notes and identify affected plugins, model routes, automations and native clients before changing the running Gateway.
- Preview the update with
openclaw update --dry-run, then confirm the intended release channel and installation owner. - Run the managed update path with
openclaw update. Useopenclaw doctor --fixwhen the documented breaking migrations apply. - After restart, verify the installed version, Gateway health, plugin inventory and policy diagnostics. The guide lists
openclaw healthandopenclaw doctor --lint --jsonamong the relevant checks. - Review shared-session membership, automation grants, credential destinations, model allowlists and sandbox requirements before resuming unattended work.
The breaking changes need explicit attention
The bundled OpenProse plugin and /prose command are removed. Existing users must clean stale configuration and follow the upstream Agent Skill migration while retaining their existing .prose source files. Shipped codex/* and openai-codex/* routes also migrate to openai/*; Doctor can perform supported migrations and flags conflicts that need operator repair.
The release notes also warn plugin developers about SDK migration gates dated September 1, 2026. Those entries are upcoming compatibility requirements, not features already removed by v2026.8.1. Signed and notarized macOS 2026.8.1 builds are available, while new iOS and Android distributions follow separately. Earlier Android downloads should not be represented as 2026.8.1 native artifacts.
What operators should evaluate after the upgrade
OpenClaw 2.0 makes persistent, shared and remote agent work easier to organize. The more important test is whether the new controls match an operator’s actual risk model. Teams should verify recovery, permission scope, secret destinations, remote-worker isolation and audit visibility with their own workloads before expanding unattended access.
