All articles
ArticlesSeptember 2, 20265 min read

OpenClaw 2.0: what changed and what to check first

OpenClaw 2.0 moves sessions into SQLite, adds shared cloud sessions and a rebuilt web UI. What changed, what breaks, and what to check before you upgrade.

openclawopenclaw 2.0ai agentsopen sourcesqliteagent securityself-hosted ai
OpenClaw 2.0: what changed and what to check first

OpenClaw 2.0 shipped on August 30, 2026, and it is the biggest release the project has ever done. The team says it is built from more than 16,000 pull requests by 933 contributors, 569 of them first-timers. That is roughly half of every pull request ever merged into OpenClaw, landing in one version.

I run agents for boring standing jobs: watch an inbox, summarize a feed, ping me when something matters. OpenClaw is one of the main open-source options for that kind of personal agent, so a release this size is worth reading closely before you hit upgrade.

What shipped in OpenClaw 2.0

The release post is honest about how this happened. The team had shipped 106 releases in 230 days, then went almost seven weeks without one. They started by simplifying installation and rebuilding the browser app, and the cleanup kept spreading until it touched everything.

The parts I care about as a builder:

  • Guided setup that starts from what you already have. It looks for Codex, ChatGPT or Claude CLI sign-ins, API keys, and local models in Ollama or LM Studio. Then it sends a real request to prove the chosen model answers before it saves anything.
  • A rebuilt Control UI. Conversations sit in the middle, with files, approvals and live work next to them. In OpenClaw's own test harness, startup went from about 1.6 seconds to 575 ms and JavaScript requests from 140 to 45, according to MarkTechPost's write-up.
  • SQLite for sessions and transcripts. No more file-backed session storage.
  • Shared cloud sessions. Someone else can read, suggest, work in a draft, or fully take part in a running session, with the agent's context intact.

There is also a /btw command that opens a side conversation, so a quick question doesn't pollute the main transcript. Small thing. I want it in every agent tool I use.

The SQLite move is the real breaking change

Moving sessions into a database is the right call. File-per-session storage gets slow and messy once an agent has months of history, and SQLite gives you indexes, transactions and one file to back up.

The catch is the downgrade path. Per the v2026.8.1 release notes and Help Net Security, if you want to go back to an older file-backed build, you first have to restore archived legacy transcripts with the new CLI. Sessions you create after the migration will not exist in the old build at all.

So the upgrade is a one-way door unless you prepare:

  1. Stop the Gateway and copy the whole OpenClaw data directory somewhere safe.
  2. Upgrade, then run openclaw doctor --fix, which Big Hat Group's weekly notes say performs the migrations.
  3. Open a few old sessions and check they came through before you delete anything.

If OpenClaw runs real work for you, treat this like a database migration. It is one.

Shared cloud sessions are not a security boundary

This is the line I'd underline. OpenClaw's own docs say the sharing controls are not tenant isolation and not a security boundary. Revoked access can briefly still look available until the UI refreshes or the Gateway rejects the action.

That is fine for a family or a small team who already trust each other. It is not fine if you were planning to put OpenClaw behind a product and let customers share one Gateway. MarkTechPost put it plainly: deployable for single-operator and single-team setups, not for multi-tenant products. I agree.

Two more details from the Help Net Security review are worth knowing. Incognito is narrower than it sounds: the chat stays in process memory and skips the transcript, but the model provider still gets every message and tools can still write files. And the faster startup has a cost. The Control UI keeps a bounded transcript snapshot unencrypted in the browser profile, which matters on a shared machine.

Model choice as a security control

One part of the security docs surprised me. OpenClaw treats model choice as the first defense against prompt injection, and cites a crowdsourced test of 272K attacks where success rates ranged from 0.5% on Claude Opus 4.5 to 8.5% on Gemini 2.5 Pro.

I like that they publish numbers. But the same page warns that adaptive human attackers still beat state-of-the-art defenses more than 80% of the time. A safer model lowers the odds. Tool policy, exec approvals and sandboxing are what actually stop the damage. If your agent can send email or run shell commands, gate those actions no matter which model you pick.

My take

OpenClaw 2.0 reads like a project that grew up. Setup that proves the model works before saving it, a real database under the sessions, and docs that tell you where the security edges are. That last part is rare.

It also matches what I keep seeing in my own work. As code gets cheap to write, review becomes the bottleneck, and agent tools now compete on handoff, approvals and audit history more than on raw model access. When I built the AI agents plugin for erxes, the hard parts were the same ones: who approved what, and what the agent remembers.

My advice: upgrade a test Claw first, back up the data directory, and wait for a stable 2026.9.x if OpenClaw runs anything you'd miss.

FAQ

Is OpenClaw 2.0 a free upgrade?

Yes. OpenClaw is open source. You pay only for the model provider you connect, or nothing if you run a local model.

Can I roll back from OpenClaw 2.0?

Yes, but not for free. You must restore archived legacy transcripts with the current CLI first, and sessions created after the SQLite migration will not appear in the older release. Take a verified backup before upgrading.

Can I use OpenClaw 2.0 for a multi-tenant SaaS product?

Not safely as-is. The project's own docs say shared sessions are not tenant isolation. Run one Gateway per trust boundary.

Sources

Cover image: OpenClaw

Related articles

OpenCode 2.0: background service, Code Mode and subagents
Articles

OpenCode 2.0: background service, Code Mode and subagents

OpenCode 2.0 adds one background service for every client, Code Mode for MCP tools, and background subagents. What changed, what breaks, and how to upgrade.

Building a YouTube AI chat Chrome extension with no backend
Case Studies

Building a YouTube AI chat Chrome extension with no backend

Case study: ChatYouTube, an open-source YouTube AI chat Chrome extension with playhead-aware chat, WebRTC voice and pluggable search. BYO key, no backend.

Building an AI Agent Platform in erxes CRM in 12 Days
Case Studies

Building an AI Agent Platform in erxes CRM in 12 Days

A case study of how I built an AI agent platform in erxes CRM in 12 days with Mastra, addressing RAG, tools, and production architecture.

Code Has Become Cheap: AI Review Is the New Bottleneck
Articles

Code Has Become Cheap: AI Review Is the New Bottleneck

AI has made writing code cheaper, but identifying high-quality code, reviewing it, and delivering it reliably are becoming the new engineering bottleneck.