OpenClaw 2.0: shared sessions aren't a security boundary

OpenClaw 2.0 shipped on August 30 after a seven-week pause, and it is the largest release the project has ever cut: roughly half of every pull request ever merged into OpenClaw landed at once. The marquee feature is shared cloud sessions — multiplayer for your agent, so a teammate can be pulled into live work with the context intact. Before anyone at your shop turns that on, read what the project says about it in plain text: these controls are not tenant isolation and not a security boundary.

What actually happened

Per OpenClaw's own release post and the v2026.8.1 release notes:

• 933 contributors, 569 of them first-timers, across more than 16,000 merged pull requests — about 50% of all PRs ever merged into the project.
• Shared cloud sessions. Work runs on paired devices or cloud workers and the session workspace moves with it. One durable progress card follows a session across web, macOS, iOS, Android, and dashboard views.
• A rebuilt Control UI as a first-class browser app for conversations and configuration. OpenClaw reports startup dropping from roughly 1.6s to about 575ms and JS requests from 140 to 45 — measured in its own simulated environment with a mocked gateway, not a field benchmark.
• Simplified install that reuses local models and API keys already on the machine, plus model discovery for Qwen, DeepSeek, NVIDIA, and GLM variants, and installable provider packages (BytePlus, ComfyUI, Mistral, others).
• Breaking changes that will bite: the bundled OpenProse plugin and /prose command are gone, codex/* model references migrate to openai/* routes, and several SDK import paths are slated for removal on 2026-09-01 — tomorrow.

There is also a plugin trust review flow — inspect an external plugin's capabilities, source, and version before it runs — and an openclaw security audit command for checking access and tool exposure.

Why the trust boundary matters for your business

Open-source agent runtimes are how a small team gets leverage without renting a seat per person forever. We like that. But "multiplayer" and "multi-tenant" are different words, and OpenClaw is being honest about which one it shipped.

The practical reading: one trust boundary per gateway. Everyone who can reach a gateway is effectively inside the same blast radius — same tool exposure, same credentials, same reachable files. The per-user controls in the multiplayer layer are convenience, not containment. So if you want your contractor, your bookkeeper, and your ops lead on agent workflows, that is not one shared gateway with three logins. That is three gateways, each scoped to the credentials and tools that role actually needs.

Two more operator notes. Run openclaw security audit before rollout, not after an incident — tool exposure is the thing that turns a helpful agent into an insider. And pin your version. A release that merges 16,000 PRs and removes a bundled plugin, a slash command, and a set of SDK import paths on a dated schedule is not a release you take automatically on a Monday morning. Read the breaking-change list, test on a copy, then move.

Half of a project's lifetime PRs landing in one drop is a real gift from 933 people. It is also a lot of new surface.

Sources: OpenClaw blog, OpenClaw v2026.8.1 release notes.