OpenClaw 2.0 Makes Sessions Portable, Credentials Private, and Plugins Explicit
OpenClaw's largest release reframes a personal agent as an operating system for durable work: sessions can move to other machines, progress survives reloads, credentials stay outside chat, and extension trust becomes a visible decision.
OpenClaw Updates
Version 2026.8.1 Becomes OpenClaw 2.0
The official OpenClaw 2.0 release notes for version 2026.8.1 describe a rebuilt web experience, simpler onboarding, stronger memory and session continuity, and a broad reliability pass. The headline features are unusually practical: exact-phrase conversation search, durable progress cards, structured question responses, interactive dashboards, masked credential requests, and reusable approvals for recurring operations.
Sessions can now run beyond the Gateway on paired devices or cloud workers, carry their workspace with them, and reuse warm machines or project seeds. That changes the unit of work. A session is no longer merely a transcript tied to the computer where it began; it becomes a portable execution record with placement, files, progress, and a route back to the user.
Interactive widgets can be pinned to session dashboards, restricted to specific actions or network origins, and exported as images. Meanwhile, progress cards survive reloads and expose subagent activity and accumulating edits. Together, these features make the Control UI less like a chat window and more like an operations console where long-running work can be watched, redirected, and understood.
Portability is only useful when ownership travels with the work. The important test is not whether a cloud worker can continue a session; it is whether the operator can still see the active workspace, permission mode, tool decisions, progress, and final delivery after placement changes. OpenClaw 2.0 supplies more of that connective tissue than any single feature name suggests.
Memory Gets More Active—and More Deliberate
OpenClaw 2.0 enables bounded same-agent conversation recall by default for personal installations using Active Memory, while excluding groups and channels. Grounded dreaming promotes provenance-qualified material into long-term memory, and automatic self-learning can apply scanner-approved or Workshop-owned skills. User-authored changes remain proposals, preserving a human checkpoint around new procedural behavior.
The release also keeps sessions across day boundaries when no reset policy is configured, offers Claude Code, Codex, and Hermes memory imports during onboarding, and adds recoverable database backups into operator-owned Git repositories. These are separate mechanisms with different risk profiles: recall selects past context, dreaming consolidates it, skills alter procedure, and backups preserve state. Operators should audit them separately instead of treating “memory” as one switch.
Security Practice
Keep One Trust Domain per Gateway
The OpenClaw security guide and trust-boundary matrix explicitly frame a Gateway and its paired nodes as one operator trust domain. Team roles can narrow which agents, sessions, and operator scopes a verified person sees, but the 2.0 notes warn that these collaboration controls are not hostile-tenant isolation.
If participants do not trust one another, use separate Gateways and preferably separate OS users or hosts. Keep powerful sessions sandboxed, treat fetched pages and shared-room history as untrusted input, and bind credentials to narrow destinations. A session key routes context; it is not an authentication boundary, and an allowlisted sender is not automatically safe prompt content.
Practical drill: inventory every user, node, credential, and externally reachable channel attached to a Gateway. For each one, record its trust domain, required tools, egress destinations, and recovery owner. Anything that cannot share one blast radius belongs on another Gateway.
Tool Spotlight: Private Credential Requests
Secrets Can Bypass Chat and Model Context
OpenClaw 2.0 lets an agent ask for a credential through a masked prompt without placing the value in the conversation or model context. An opt-in proxy can restrict protected-secret substitution to approved destinations, while the shared credential store keeps secret values write-only and distinguishes them from readable environment settings.
This is a better pattern than asking a user to paste a token into chat, but it is not magic containment. The release notes state that a 1Password broker can expose a selected value to the model for that specific tool execution. Operators still need per-secret approval, destination binding, value-free audit records, and a clear distinction between substitution that occurs outside the model and tool reads that do not.
Operator check: test a permitted host, a look-alike domain, a redirected request, and an unapproved tool before trusting the flow. Credential safety is demonstrated by denied paths and redacted logs, not by a masked input box alone.
Plugins and Breaking Changes
Extension Trust Becomes an Explicit Installation Step
The official OpenClaw plugin installation and provenance guide says to treat plugin installation as running code. Arbitrary executable sources now require --force after review, while trusted ClawHub, bundled, official-catalog, and tracked-update sources avoid that provenance warning but still require capability consent. Production installations should pin versions and verify the loaded runtime, not stop at a cold manifest check.
OpenClaw 2.0 also moves Cohere, Meta, DuckDuckGo search, Voyage embeddings, and iMessage into separate official plugins, alongside a larger provider catalog. This makes capabilities more modular, but it also makes inventory discipline essential. An installed package, an enabled plugin, an allowlisted identifier, and a capability proven in the running Gateway are four different facts.
Two migrations deserve attention before upgrade day. Bundled OpenProse and its /prose command are removed in favor of the upstream Agent Skill migration, while legacy codex/* and openai-codex/* model references move to canonical openai/* routes. The project directs operators to back up first and use openclaw doctor --fix to repair supported configuration paths and surface conflicts.
Community and Ecosystem
Viral Scale Forces Maintainers to Redesign Review
A new GitHub interview with OpenClaw's maintainers on contribution and supply-chain security reports approximately 388,000 stars, 81,000 forks, and more than 80,000 commits as of August 26. The maintainers describe a flood of AI-assisted pull requests that changed the bottleneck from attracting contributions to finding the valuable changes among them.
The community response is not to ban agent-assisted work. Maintainers describe helping first-time contributors refine useful ideas while tightening review, permissions, branch protection, and release discipline. That balance matters because accessibility and supply-chain safety can pull in opposite directions: a project can welcome new builders without granting unearned publication authority.
Paperclip Positions Itself Above Individual Agents
The adjacent Paperclip open-source multi-agent orchestration repository frames OpenClaw, Claude Code, Codex, and other harnesses as workers inside a company-like layer of goals, budgets, org charts, governance, and accountability. Its own comparison is direct: if an agent is an employee, Paperclip is the company.
That positioning shows where the ecosystem is moving. OpenClaw 2.0 makes one agent system more portable, collaborative, and observable; orchestration projects are trying to coordinate many such systems against shared goals and spending limits. The unresolved question is whether higher-level dashboards represent live, maintained truth or merely produce convincing projections of stale agent state.
OpenClaw 2.0's real milestone is explicitness. Placement is visible, recurring authority is bounded to an exact operation, credential handling has named paths, plugins carry provenance, and collaboration controls state what they are not. The next ecosystem winners will preserve that clarity when multiple agents, companies, memory layers, and external orchestrators begin sharing one operational picture.
Need help with OpenClaw deployment?
SEN-X provides enterprise OpenClaw consulting — architecture, security hardening, custom skill development, and ongoing support.
Contact SEN-X →