OpenClaw 2.0 Ships a Team Workplace With Host-Trust Defaults

OpenClaw 2.0 shipped August 31 as v2026.8.1, a chat-first workspace for shared agent sessions that the project spent two months building with its own agents. The same drop still starts with sandboxing off, the gap Microsoft already closed in Scout by treating OpenClaw as untrusted.

Creator Peter Steinberger works at OpenAI. The release came from the OpenClaw Foundation, not from his employer, and OpenAI did not post it.

OpenClaw 2.0 Puts a Whole Team in One Session

The old product was a personal harness. You ran an agent on a laptop, talked to it in Telegram or Discord, and the working memory lived with you. Colleagues could message the bot. They could not step into the same live context.

v2026.8.1 rebuilds the browser Control UI around a conversation. Threads sit in a sidebar. Files, approvals, terminals, git diffs, and live agent activity sit next to the chat instead of on a separate overview screen. Shared cloud sessions let a second person join work already in progress, with ownership, presence, and typing indicators that look closer to a team editor than a chatbot.

Hannes Rudolph, who leads community at the Foundation, wrote the official story. The team hit a wall that is familiar to anyone who has tried to pass an agent chat to a coworker: OpenClaw had no way to bring another person into the work without losing what the claw already knew. Shared sessions are how they now build the product.

Colin Johnson, chief executive of marketing metrics firm Solvely, described the same shift on his own server. His developers had been assigning tasks through Discord, which still felt like talking to a bot. Two people can now open one live session, see the same history, and add context without writing a handoff note.

The session itself became the handoff document.

Colin Johnson, CEO, Solvely, on X

https://x.com/colinsolvely/status/2094624645760610589

His Gateway sits on a development box behind GitHub login, Cloudflare Access, and a Cloudflare Tunnel, listening only on loopback. He also said the quiet part: Cloudflare decides who can walk in, OpenClaw tracks who typed, and that is not a wall between untrusted tenants. The people behind it already share repos and tools.

WHAT LANDED IN V2026.8.1

• Chat-first Control UI: Conversations replace the old overview page, with files, approvals, and live work kept beside the thread.
• Shared cloud sessions: A teammate can join a live agent with read, suggest, draft, or full access instead of rebuilding the context.
• Team operator roles: Named roles limit which agents and sessions a verified user can see, and can require a sandbox for new sessions.
• Auth-gated network installs: The installer now stops a network Gateway setup that would go live without a login.
• Guided model setup: First-run flow can reuse ChatGPT, Claude, or Codex logins, an API key, or a local model, and it checks that the choice answers before it saves.

GitHub’s release notes for the team roles are blunt. They are collaboration controls, not isolation between hostile tenants. One Gateway is still one trust domain. Bigger splits still need separate Gateways, which the project calls cells, and fleet tooling for those cells is experimental.

A Host-Trust Install With New Locks on the Door

The workplace features assume people who already share a repo. The default runtime still assumes one trusted operator on a machine they own. OpenClaw’s sandboxing page states that sandboxing is off by default, with the Gateway left on the host and only tool runs moved into Docker, Podman, SSH, or OpenShell when someone turns it on.

Exec policy matches that posture. On a gateway or node host, exec security defaults to full. Session permission docs say that without extra settings or a sandbox, the default is full filesystem access. Elevated mode, the escape hatch out of a sandbox, does nothing in that setup because exec is already on the host.

Admins can now require a sandbox for sessions created by a named role, and that rule is supposed to fail closed if the sandbox cannot start. Approvals can be tied to a request, a command, a session, and a person. A team Secret Store can inject a protected credential into a Gateway HTTPS call without handing the secret to the model. Plugin installs can show a capability review. Those are real locks. They are not the keys the installer turns for you.

OPENCLAW 2.0 DEFAULTS AGAINST HARDENED SETUPS

The new installer does close one old hole. Network setups that would expose a Gateway with no login are blocked before anything changes. That matters because the winter scare was not a lab demo. Bitsight, in a February note, counted more than 30,000 reachable OpenClaw instances between January 27 and February 8, and a honeypot on port 18789 drew probes within minutes.

A later chain of sandbox bugs, CVE-2026-44112 among them at CVSS 9.6, was patched on April 23 in 2026.4.22, months before 2.0. The new version is not that patch train. It is a workplace UI on top of a runtime that still lets a first-run operator execute on the host unless someone changes agents.defaults.sandbox.mode.

Microsoft Already Ships the Locked-Down Version

While the Foundation spent July and August turning OpenClaw into a shared browser app, Microsoft had already productized the opposite bet. On June 2 it launched Scout, an always-on personal agent built on OpenClaw, wired into Teams, Outlook, OneDrive, and SharePoint.

The Foundation’s July post quotes Satya Nadella calling Autopilots “enterprise grade Claws.” Scout’s own blog says it is built with enterprise security so it can be trusted from day one, and that it is powered by OpenClaw. The interesting sentence is the one Omar Shahine, corporate vice president of Microsoft Scout, gave The Verge: Microsoft runs OpenClaw in a cloud sandbox and treats the agent as untrusted, with no secrets and no path into Microsoft 365 data.

We operate OpenClaw in a cloud environment that’s in a sandbox, and we treat OpenClaw as untrusted so it doesn’t have secrets or access to any of your Microsoft 365 data.

Omar Shahine, Corporate Vice President of Microsoft Scout, The Verge

That is not a review of 2.0. It is a description of how a partner already ships the same codebase. Agent 365, Purview, and Defender sit outside the container. Packages come through a signed Microsoft supply chain. The open project still asks a company to assemble that stack itself.

NVIDIA took a hardware path. The Foundation says NemoClaw with open Nemotron models installs OpenClaw plus the OpenShell runtime in one command, aimed at a private claw on local machines. Jensen Huang’s line, quoted in the same Foundation post, was that every company needs an OpenClaw strategy. Cadence, Siemens, Synopsys, and Dassault Systèmes are named as industrial users of that wrap, not of a stock openclaw install with sandbox left off.

Google has its own OpenClaw-based agent, Spark. The pattern is the same. Labs take the commons, then put identity, a sandbox, and a policy box around it before employees touch it. 2.0 gives the commons a team UI. It does not copy Scout’s starting posture.

The Opposite Default From NanoClaw

NanoClaw exists because Gavriel Cohen, who built it, did not want an agent on the host. In a February essay he wrote that OpenClaw runs on the machine unless you opt into Docker, and that most people never flip that switch. Application allowlists and confirm prompts, he argued, assume the agent will behave. His design assumes it will not.

Each NanoClaw agent gets its own container, filesystem, and session history. The process runs as an unprivileged user. Only listed directories are mounted. Sensitive paths such as .ssh, .aws, and .env are blocked by default, and the allowlist lives outside the project so a bad agent cannot rewrite its own permissions. Credentials can pass through OneCLI’s Agent Vault at the gateway instead of sitting in the container.

Cohen also attacked size. He put OpenClaw in the 400,000-line class with dozens of config files, and said nobody had reviewed that surface the way a small project can be read in an afternoon. NanoClaw keeps a tiny core and adds features as skills you merge on purpose. Whether his line count still matches 2.0 is a moving target. The default is not. OpenClaw’s own sandbox page still matches the charge he made in February.

2.0 can now stand up Docker or Podman sandboxes, per-agent or per-session scope, read-only or read-write workspace access, role-enforced sandboxing, remote nodes, and disposable cloud workers. That is closer to NanoClaw on a checklist. The starting posture is still the other product’s reason for existing. Cohen’s essay still reads as the clean statement of container isolation as a core design, not a plugin.

On X, the 2.0 thread did not turn into a security argument. It turned into a setup argument. People still treat install as a specialist job, even after guided onboarding that reuses a ChatGPT or Claude login. The caution that keeps coming back is the new multiplayer Gateway, not the lobster in the sidebar.

16,000 Pull Requests After Seven Quiet Weeks

The Foundation did not plan a 2.0. Rudolph’s post, titled OpenClaw 2.0, Accidentally, says the work started as simpler setup and a first-class browser app, then ate the rest of the stack. It credits 933 contributors and 16,000 pull requests, including 569 first-time contributors, and says that haul is about half of every pull request ever merged.

THE 2.0 RELEASE BY THE NUMBERS

• 933 contributors: 569 of them had never landed a change in the repo before this cycle.
• 16,000-plus pull requests: Rudolph says that is roughly half of all pull requests ever merged into OpenClaw.
• 106 releases in 230 days: The old cadence was a ship every day or two, then almost seven weeks of silence.
• 388,294 GitHub stars: The org page showed 81,519 forks on September 1, with 3,635 open issues.

Steinberger framed the two months as a mission to build OpenClaw with OpenClaw. The team moved off local coding harnesses and onto team.openclaw.ai, a shared agent environment that could see what people were working on. Multiplayer coding with nodes and cloud sessions, he wrote, changed how they build. Local harnesses, he added, now feel like relics of the past.

https://x.com/steipete/status/2094290652649636173

A GitHub maintainer interview posted August 27, four days before the tag, had already described the cost of that speed. OpenClaw is called the fastest-growing project in GitHub history in that piece, at about 388,000 stars, 81,000 forks, and more than 80,000 commits by August 26. Maintainers talked about pull requests arriving as prompt dumps, with some people opening hundreds at once. The seven-week pause reads less like polish for its own sake and more like a process that had to be rebuilt so humans could still review the flood.

The Foundation said in July that 4.5 million new claws were being created every week. That figure is the project’s own, and it is two months old. What 2.0 actually proves is narrower. A high-trust maintainer group can live inside one shared session. That is not the same as a bank, a hospital, or two business units sharing one Gateway.

The OpenClaw Foundation Still Holds the Project

Steinberger joined OpenAI on February 14, with Sam Altman confirming it the next day. He said then that OpenClaw would move to a foundation and stay open. The paperwork caught up on July 8. OpenClaw is a U.S. 501(c)(3). Dave Morin is chair. Steinberger still makes the technical calls. Vincent Koc is chief architect. OpenAI funds inference, shipped hardening work branded Codex Security, and runs Claw Labs inside the company with Steinberger in the lead. It is a major donor. It is not the publisher of v2026.8.1.

FROM WEEKEND PROJECT TO FOUNDATION RELEASE

1. November 2025: Steinberger starts a weekend assistant in Austria. The repo later records the name path Warelay to Clawdbot to Moltbot to OpenClaw.
2. February 14, 2026: He joins OpenAI to work on agents and says OpenClaw will stay independent under a foundation.
3. April 23, 2026: Version 2026.4.22 patches the Claw Chain sandbox and privilege bugs, including CVE-2026-44112.
4. June 2, 2026: Microsoft launches Scout at Build on OpenClaw, with identity and policy outside an untrusted container.
5. July 8, 2026: The OpenClaw Foundation goes live as a 501(c)(3), with Morin as chair and a first full-time staff.
6. August 31, 2026: steipete tags v2026.8.1. The Foundation, not OpenAI, ships OpenClaw 2.0.

Partners listed in July include NVIDIA, Microsoft, the University of Michigan, Red Hat, Tencent, Atlassian, Blacksmith, Vercel, Cloudflare, Convex, and GitHub. Michigan is named as the largest donor and launched an Institute for Agentic Computing. Tencent added full-time maintainers on security and ClawHub. Atlassian pushed on deployment, audit trails, identity boundaries, and secrets. The Foundation calls itself the Switzerland of AI, neutral ground for every model lab. 2.0 is that commons getting a team face, not OpenAI shipping an agent workplace under its own name.

The docs still carry limits the Foundation does not hide. Secret Store values are not encrypted at rest. Protected credential substitution does not cover every path, including some raw sockets, containers, remote nodes, and provider-native harnesses. Multi-user permissions govern trusted coworkers. They do not wall off customers who should be treated as hostile.

Even the updater keeps a tell. If the automatic update fails, the GitHub notes say, use a local coding harness to finish the job, diagnose migration errors, and check that the Gateway starts. The relics are still in the runbook.

Frequently Asked Questions

What Version Number Is OpenClaw 2.0?

The stable tag is v2026.8.1, published August 31. Fresh OpenAI API-key setups in this release default to GPT-5.6, and the Mac, Linux, and Windows installer path now pins CLI installs to Node 22.22.2. The 2.0 name is a product label; the repo still versions by calendar.

Is Sandboxing on by Default in OpenClaw 2.0?

No. The mode key accepts off, non-main, or all, and the shipped default is off. The default backend is Docker, with Podman, SSH, and OpenShell as the other options, and a creator role can still force a sandbox on new sessions even when the agent-wide mode is off. Non-main mode sandboxes group and channel sessions while leaving the agent’s main session on the host.

Who Runs OpenClaw After Peter Steinberger Joined OpenAI?

The OpenClaw Foundation, a U.S. 501(c)(3), holds the repo, the mark, and the MIT license. Dave Morin is chairperson, Vincent Koc is chief architect, and Hannes Rudolph leads community. The University of Michigan is named as the largest donor. OpenAI is a major donor and runs Claw Labs, but v2026.8.1 is a Foundation release.

Can One OpenClaw Gateway Serve Untrusted Tenants?

No. The project says a Gateway should be treated as a single trust domain. Team roles decide who can read, suggest, or join a session among people who already trust one another. Stronger splits, such as two business units or two customers, are supposed to use separate Gateway cells with their own state, credentials, and workspaces, and the fleet tools for those cells are still experimental.

How Is Microsoft Scout Related to OpenClaw 2.0?

Scout, launched June 2, is Microsoft’s Autopilot agent for Microsoft 365 and is powered by OpenClaw. It is a separate product with its own identity, Agent 365 admin plane, and a runtime that treats the OpenClaw code as untrusted. 2.0 does not turn a self-hosted Gateway into Scout; it adds a team UI and optional controls that a company still has to switch on.