OpenClaw 2.0 Released: Installation Overhaul, Browser UI Redesign, and Shared Cloud Sessions

The release blog post for OpenClaw 2.0 is titled 'OpenClaw 2.0, Accidentally.' Team member Hannes Rudolph explains that the team originally intended to do only two things: simplify the installation process and elevate the browser experience to a first-class citizen. However, during the changes, they found they couldn't cleanly wrap up, so they had to clean up as they went, ultimately resulting in a complete major version.

This update is unprecedented in scale: 933 contributors participated, of whom 569 made their first code submission, and the number of merged pull requests exceeded 16,000, roughly half of OpenClaw's total merges to date. Previously, the project had gone nearly seven weeks without a new release, while in the earlier 230 days, 106 versions were released, averaging one or two days apart. The blog explains that while the release cadence slowed, development accelerated, the team grew, and the workload and speed exceeded what the original codebase and release process could handle, so both were reworked.

The installation process was completely overhauled. The new guided installation first scans the machine for existing AI access permissions, can reuse verified Codex, ChatGPT, or Claude CLI logins, accept API keys, go through the provider's own login flow, or find locally installed Ollama and LM Studio models. It then verifies that the specific choice can respond, and stores the model and credentials. New OpenAI configurations default to GPT-5.6, and on the local side, node-llama-cpp is replaced with hosted llama-server, with the default context length for llama.cpp increased to 64K. Many configuration options were removed or moved out of the initial setup, with the rest configured progressively as users interact with the agent.

The browser-based Control UI was rewritten to be chat-first: the old Overview page was removed, sessions moved to the sidebar, and the current conversation is centered. File, approval, terminal, Git changes, and dockable browser panels sit alongside the conversation, with tool calls and results displayed in pairs, and file changes focused on diffs. A new /btw command enables separate multi-turn side conversations to avoid polluting the main thread. Performance numbers come from a simulated test environment (mocked Gateway, 50ms HTTP/1.1 latency): JavaScript requests dropped from 140 to 45, and startup time dropped from about 1.6 seconds to 575 milliseconds.

The underlying storage migrated from files to SQLite, but downgrades are no longer free: before rolling back to the old file-based storage version, you must use the current CLI to restore archived transcripts in the old format. Sessions created after migration will not appear in older versions. The official recommendation is to perform a verified backup before upgrading.

Shared cloud sessions are the most product-oriented change. Rudolph says the feature was developed out of the team's own usage: during 2.0 development, they increasingly delegated work to their own Claw, but found they couldn't bring others into tasks without losing context. Now, session owners or admins can decide permissions for others: read-only, suggest, work in drafts, or participate directly. But the documentation is blunt about limitations: these controls are not tenant isolation and do not constitute a security boundary; after permission revocation, the UI may briefly show availability before refresh. Incognito mode is off by default, with conversations kept only in process memory, not written to disk transcripts or auto-memory, and disappearing on Gateway restart, but messages are still sent to model providers, and tools can still write files and affect external services.

On the security front, the Gateway binds to loopback by default, most chat channels return a pairing code to unknown private message senders, and the 'openclaw security audit' command checks inbound access, tool impact radius, network exposure, browser control exposure, and plugin whitelist. The documentation treats model selection as the first mitigation against prompt injection, citing 2026 crowdsourced attack arena data: across 41 agent scenarios and 272,000 attacks, counting only those where the agent both performed harmful actions and concealed them from the user, Claude Opus 4.5 had a 0.5% compromise rate, Sonnet 4.5 1.0%, Haiku 4.5 1.3%, and Gemini 2.5 Pro 8.5%. But the same page also states that against adaptive human attackers, the best existing defenses still have a breakthrough probability exceeding 80%, so tool policies, execution approvals, and sandboxes are the real enforcement layers.

Over the past six months, OpenClaw has often been asked 'Is it dead?' in both Chinese and English communities, with waning enthusiasm from users and contributors compared to launch. The 2.0 changes—reusing existing login credentials, SQLite storage, 30-day approval history, destructive downgrade warnings, and multi-user collaboration documents stating 'not a security boundary'—show the project shifting from a demo to a production tool, which is exactly what was most lacking during the frenzy from January to March. Whether 2.0 can bring people back remains to be seen.