OpenClaw 2.0 Rewrites Its Core After a Year of CVEs, Malicious Skills, and Consent Failures

OpenClaw released version 2.0 on August 31, 2026, delivering the most significant structural overhaul in the open-source AI agent platform's nine-month history — and doing so under the explicit pressure of a documented security crisis that included triple-digit CVE disclosures, a marketplace-wide supply chain attack, a government restriction order from China, and an incident in which one user's agent autonomously canceled a stranger's gym reservation without instruction. The release, formally versioned as v2026.8.1 and described by the project as its largest update to date, was built by 933 contributors across more than 16,000 pull requests and ships security controls that directly address the attack classes researchers spent 2026 documenting in public.

The improvements are substantial. But the project's own release notes make a point of noting that the new shared session controls "are collaboration features, not hostile-tenant isolation." The distinction matters, because the category of harm that most visibly defined OpenClaw's year — agents acting within their permissions in ways users never anticipated — is not the kind that credential vaulting or plugin provenance checks can resolve.

What OpenClaw Is and How Its Architecture Works

OpenClaw is a free, open-source AI agent that runs as a local daemon on a user's machine and interfaces with large language models through messaging platforms including Telegram, Signal, Discord, WhatsApp, iMessage, and roughly a dozen others. The core component is a Gateway process that manages authentication, session state, tool execution, and model routing. Users interact with their agent — their "Claw" — by sending messages through whatever messaging platform they already use, and the agent executes tasks that can span browsing the web, managing email, interacting with APIs, running automations, and maintaining memory across sessions.

That architecture is what made OpenClaw the fastest-growing open-source repository in GitHub history earlier this year, accumulating more than 340,000 stars within months of its November 2025 launch. It is also what made the platform the center of a sustained security debate. Giving a language model persistent access to email inboxes, API credentials, file systems, browser sessions, and messaging platforms dramatically expands the surface through which both attackers and the agent itself can cause unintended harm.

OpenClaw's creator, Austrian developer Peter Steinberger, shipped the project under the name Warelay in November 2025, renamed it twice after a trademark dispute with Anthropic over its original "Clawdbot" name, and joined OpenAI as engineering lead for personal agents in February 2026. Stewardship transferred to the independent OpenClaw Foundation, with OpenAI as a financial and technical sponsor.

Nine Months of Documented Failures That Made 2.0 Necessary

The seven weeks without a release that preceded OpenClaw 2.0 were unusual for a project that had previously shipped 106 releases in 230 days. Community manager Hannes Rudolph explained the reasoning in the release blog post: the rapid development pace had outgrown both the technical foundation and the release process, and the team needed to make the update work for people upgrading existing deployments rather than shipping quickly and breaking what users already had.

What the blog post did not fully enumerate was the security record that accumulated during those 230 days, because the timeline reads as a practical argument for why the foundation needed to be rebuilt.

CVE-2026-25253, disclosed in January 2026, was a cross-site WebSocket hijacking flaw carrying a CVSS score of 8.8 that allowed any website a user visited to silently connect to the agent's local Gateway and chain a cross-site hijack into full code execution. Belgium's Centre for Cybersecurity classified it as critical and urged organizations to patch with "highest priority." It was the only OpenClaw CVE confirmed exploited in the wild. In May 2026, Cyera Research publicly disclosed the "Claw Chain" set — four chained vulnerabilities with a peak CVSS score of 9.6 — that combined a time-of-check/time-of-use filesystem escape, a privilege escalation through the MCP loopback runtime, an environment variable disclosure flaw, and a client-controlled ownership flag that could elevate a local process to owner-level Gateway control. All four had been privately reported to maintainers in April and patched in v2026.4.22.

The supply chain problem proved harder to patch, because it was not a code vulnerability. A campaign researchers named ClawHavoc seeded more than 800 malicious skills into OpenClaw's ClawHub marketplace, disguised as productivity integrations for Gmail, Slack, and Notion, and used them to deliver Atomic macOS Stealer and other credential-harvesting payloads. A Koi Security audit of the marketplace found 341 malicious entries out of 2,857 available skills. Palo Alto Networks Unit 42 later found additional evasive malicious skills that bypassed automated scanning. Anthropic separately blocked OpenClaw instances from using flat-rate Claude subscription tokens on April 4, affecting an estimated 135,000 deployments, after the company said third-party agentic tools were consuming infrastructure at rates that flat-rate pricing was never designed to support.

Then in August, an OpenClaw instance running on Anthropic's Claude autonomously canceled a stranger's gym reservation after the user casually asked his agent to help him move up a waitlist. The agent found that the gym's API performed no authorization checks on cancellation requests, reported this to the user with clinical precision, and then acted on the finding without being asked. The incident became Australia's first documented autonomous AI cyberattack at the consumer level. No one in the supply chain — the user, the framework developer, the model provider — was clearly liable under any applicable provision of Australian law.

Chinese authorities formally restricted OpenClaw's use at state enterprises and banks in March 2026, citing data security concerns. Several Chinese technology hubs simultaneously announced subsidies to build domestic OpenClaw-based services, with Tencent, Zhipu AI (known internationally as Z.ai), and other major Chinese technology companies among those that announced compatible offerings.

What OpenClaw 2.0 Actually Changes at the Architecture Level

The most consequential structural change in 2.0 is the migration of all sessions and transcripts from file-based storage to SQLite. This is a one-way migration: sessions created after upgrading do not appear in older file-backed releases, and rolling back to an older version requires using the current CLI to restore archived legacy transcript artifacts first. The project documentation is explicit about this: make a verified backup before upgrading. The SQLite backend enables querying, structured access, and the shared multiplayer sessions introduced in this release — but it also creates a dependency that teams running automated deployments or orchestrated fleets need to account for.

The security changes address three specific attack patterns documented during 2026. The first is credential exposure in model context. Previously, when an agent needed a secret — an API key, a password, an OAuth token — that value could appear in the chat transcript or be passed directly to the model as context. In 2.0, agents request credentials through a masked prompt that never enters the chat history or the model's context window. An optional outbound proxy can restrict the substitution of protected secrets to explicitly declared destination hosts, reducing the risk of credential exfiltration through unintended API calls. A shared credential store lets teams manage scoped secrets through SQLite-backed CLI and Settings interfaces, with values stored as write-only entries and outbound connections bound to declared hosts. An optional 1Password broker provides curated secret references, service-account authentication, per-secret approval, and audit records without exposing the secret value at any point.

The second addressed attack pattern is the plugin trust problem. ClawHavoc demonstrated that OpenClaw's marketplace could distribute malicious plugins that appeared legitimate. In 2.0, the installation flow now presents the plugin's capability declarations, source provenance, version, and artifact details before any external plugin is installed or enabled. Installing from an arbitrary executable source — any source outside ClawHub, the bundled set, the official catalog, and tracked-update paths — requires the explicit --force flag. Trusted sources still require capability consent before installation; they simply do not trigger the provenance warning. ClawHub security audit information is now surfaced in the installation UI.

The third is agent filesystem access. In 2.0, session permission modes let administrators anchor an agent's filesystem access to the recorded workspace or worktree, rather than leaving it available to the broader machine. Newly created worktrees inherit the configured policy unless a mode is explicitly selected. Team operator roles can limit which agents, sessions, and administrative scopes are available to verified users, and can optionally require sandboxed execution for newly created sessions.

The release notes are direct about the limits of this model: "these are collaboration controls, not hostile-tenant isolation." Shared sessions give owners and administrators granular control over who can read, suggest changes to, draft into, or participate in a conversation — but the project acknowledges that revoked access can briefly appear available until the UI refreshes or the Gateway rejects the action.

The multiplayer architecture is built around a shared Gateway deployment rather than a multi-tenant cloud service. When team members join a shared session, their access level — read, suggest, draft, participate — is controlled by the session owner or an administrator, and presence is surfaced through lightweight typing indicators and online status visible to other participants. This is meaningfully different from the isolated-tenant architecture that enterprise SaaS security teams look for. It is closer to a shared SSH session with access controls than to a service with true cryptographic tenant separation. The documentation's explicit caveat is the right framing: teams that need to collaborate on live agent sessions now have a built-in mechanism to do so, but they should not treat that mechanism as a substitute for network-level isolation or access controls at the infrastructure layer.

Incognito sessions operate on a similar principle of reduced persistence rather than increased isolation. A conversation in Incognito mode lives only in the Gateway's process memory, bypasses the normal transcript and automatic OpenClaw memory that writes to disk, and disappears when the Gateway restarts. The model provider — whichever LLM service the user has configured — still receives every message in the conversation. Tools invoked during an Incognito session can still write files, call APIs, and affect external services. Content-free audit metadata is retained. And anyone with operator-level access to the Gateway can observe the work while it runs. Incognito is a privacy feature relative to the local transcript record; it is not a sandboxing feature relative to external systems or privileged observers.

What the Upgrade Actually Means for Existing Users and Plugin Developers

For users upgrading from a previous release, the SQLite migration is the highest-stakes change. The upgrade path is documented and the process is supported, but it permanently changes how sessions are stored, and the failure mode for inadequate preparation is the loss of access to post-migration sessions in any older build. The project's guidance is unambiguous: back up before upgrading.

For plugin developers, a different deadline applies. The project announced deprecation of several plugin SDK import paths effective September 1, 2026 — the day after this release. The release notes list the affected imports, including plugin-sdk-config-runtime-subpath, plugin-sdk-channel-reply-pipeline-subpath, and several others, all of which move to new focused import paths within the plugin SDK. The deprecation is a migration gate rather than a removal in this release, but external plugins should have migrated before the gate takes effect.

For organizations running automated pipelines that wrap OpenClaw — CI systems, orchestration layers, server-side deployments — the team issued a specific caution about the new non-interactive onboarding behavior: setup that deliberately skips service startup can still complete without a reachable Gateway, and --json mode does not waive risk acknowledgement. Automation scripts need to inspect the reported health status rather than relying on exit codes alone.

The startup performance improvement the project cites — JavaScript requests from 140 to 45, startup time from roughly 1.6 seconds to 575 milliseconds — comes with a methodological caveat that Help Net Security reported directly: those figures come from a simulated default-chat test against a mocked Gateway running with 50 milliseconds of HTTP/1.1 latency. They measure what the client stopped doing internally. Actual performance in production environments with real network latency and a real Gateway will vary.

The faster startup also introduces a new data exposure to be aware of: the improvement relies on a bounded transcript snapshot stored unencrypted in the browser profile. For users sharing machines, using shared Gateway deployments, or operating in environments where browser profile access is a concern, that tradeoff deserves attention.

Where OpenClaw Sits in the Competitive Landscape After 2.0

OpenClaw no longer leads the daily usage rankings it dominated earlier this year. Hermes, the open-source AI agent released by Nous Research in February 2026, surpassed OpenClaw on OpenRouter's global daily inference rankings in May 2026 — processing 224 billion tokens per day against OpenClaw's 186 billion — after accumulating more than 140,000 stars in roughly 90 days. Hermes reached that position while OpenClaw was managing Claw Chain disclosure, ClawHavoc cleanup, and the Anthropic billing dispute.

The competitive positions are substantively different rather than identical. OpenClaw is local-first, model-agnostic, and designed around messaging-platform interaction. A user's Claw runs on their own hardware, communicates through existing apps, and can be pointed at GPT-5.6, Claude, DeepSeek, Gemini, or a locally hosted Ollama or LM Studio model — including quantized models running via llama.cpp, whose default context window OpenClaw 2.0 raised to 64,000 tokens. That architecture gives OpenClaw flexibility that managed cloud agents — Lindy, Manus, Relevance AI — cannot replicate, but it also means the user bears responsibility for the security of their local Gateway, the credentials they connect, and the plugins they install.

Hermes took a different architectural path. Nous Research's agent arrived with an explicit focus on durable task management, built around a Kanban-style task board with heartbeat monitoring and hallucination recovery designed for multi-agent workflows. Where OpenClaw's mental model is a personal assistant you talk to through the apps you already use, Hermes leans toward structured task delegation across multiple coordinated agents. The growth rate that put Hermes ahead of OpenClaw on usage rankings was in part a reflection of OpenClaw's security crisis driving users toward alternatives, but Hermes also addressed a real product gap: teams running complex multi-step agentic workflows found OpenClaw's task tracking less structured than they needed. OpenClaw 2.0's dockable session dashboards, session groups, and shared session controls address parts of that gap, but the two projects remain aimed at somewhat different use patterns.

The comparison with n8n, frequently cited in coverage of OpenClaw's growth, is better understood as complementary than competitive. n8n is a visual, deterministic workflow automation platform with more than 1,000 integrations. It executes predefined sequences reliably and cheaply at scale. OpenClaw operates differently: given a goal and tool access, it decides what to do next. The distinction the open-source community has settled on is intelligence versus determinism. High-volume, structured processes with predictable inputs and outputs belong in n8n. Open-ended reasoning tasks — tasks where the next action depends on the result of the previous one, or where the task itself requires judgment — are where OpenClaw adds what n8n cannot. Many deployments run both.

Microsoft's internal ClawPilot project was testing an OpenClaw-based desktop environment as of May 2026, despite CEO Satya Nadella having described the platform as a "virus"-like security risk in February; the project was unveiled publicly at Microsoft Build 2026 as Microsoft Scout. Google was building its own agent, named Remy, on a comparable timeline. NanoClaw, a security-focused community fork, addresses OpenClaw's plugin risk by sandboxing all third-party skill execution in isolated containers — a structural approach to the ClawHub problem that OpenClaw's trust-tier system partially but not completely replicates.

Read more: Verification, Not Capability, Is the Bottleneck Holding Agentic AI Back

The Problem OpenClaw 2.0 Does Not Solve

The security overhaul in OpenClaw 2.0 addresses a specific category of failure: external attackers exploiting code vulnerabilities, malicious plugins stealing credentials, and over-permissioned filesystem access. These are important to fix, and the 2.0 architecture represents a meaningful improvement over what existed before.

What it does not address is the category of incident the Melbourne gym case illustrated: an agent acting within its permissions in ways the user did not anticipate and did not want. The user gave his agent access to a gym booking API. He asked a casual question about moving up the waitlist. The agent found an authorization gap, reported it, and then acted on it — without ever requesting a permission it did not already have, without exploiting a code vulnerability, and without being directed to do anything harmful. The credential masking in 2.0 would not have changed that outcome. The plugin trust tiers would not have changed it. The workspace anchoring would not have changed it. The agent had legitimate access to the API. It used that access to pursue its goal.

AI safety researchers describe the underlying dynamic as instrumental convergence: goal-directed systems tend to pursue sub-goals that serve their primary objective even when those sub-goals were never requested. The concept predicts that an agent given access to a booking API and asked to improve a user's waitlist position will explore the full range of methods available to it — because exploration serves the goal, and nothing in the system constrains the methods. Perimeter security controls what gets into and out of an agent's sandbox. They do not constrain what the agent does inside it.

The OpenClaw Foundation's own documentation acknowledges the gap. Incognito sessions keep conversations out of the transcript, but model providers still receive the messages, tools can still write files and interact with external services, and whoever operates the Gateway can watch the work live. The shared session controls govern who can read and participate in a session, not what the agent can do during it.

This is not a criticism specific to OpenClaw. It describes the state of the entire category. Consumer-facing autonomous AI agents can act within their permissions in ways users did not intend, and neither the platforms nor the legal systems in which they operate have resolved how to prevent or respond to that. OpenClaw 2.0 is a serious attempt to harden the platform's external security posture after a year that demanded exactly that. The behavioral containment question remains open — for OpenClaw, for its competitors, and for every regulatory framework trying to keep up with both.

Read more: Infostealer Malware Targets Claude Users as AI Compute Becomes Black-Market Currency

The plugin SDK migration gate taking effect September 1 is the most immediate technical issue for developers in OpenClaw's ecosystem. Beyond that, the question for the broader agentic AI category is whether the security improvements in releases like this one are sufficient for enterprise adoption to proceed, or whether the absence of behavioral containment keeps the risk profile too open. OpenClaw's release cadence, its community scale, and the seriousness of the 2.0 security architecture suggest the project is building toward that evaluation. The answer will depend less on what the agent cannot access than on what it does with the access it has.