OpenClaw shipped its biggest update ever over the weekend. The team calls it OpenClaw 2.0. They also called it “accidental,” which, fine, we’ll get to that.

The release notes touch installation, messaging, memory, skills, models, automations, the browser, native apps, plugins, and security—basically everything a user should know.

Per the announcement post, 933 contributors, 569 of them first-timers, contributed to the project with more than 16,000 pull requests. That’s roughly half of every PR OpenClaw has ever merged, shipped in a single release.

What OpenClaw actually is, for the uninitiated

OpenClaw is a self-hosted, open-source framework that turns an LLM into an agent that doesn’t go away when you close the tab. It lives on your machine, wakes up on its own schedule, and talks to you over WhatsApp, Telegram, Discord, or Signal instead of waiting politely in a chat window. Give it permission and it’ll touch your email, your calendar, your files, your shell.

Austrian developer Peter Steinberger built it after stepping back from his company PSPDFKit. His project gained a record 147,000 GitHub stars in weeks and started a whole ecosystem of spin-offs and one deeply strange AI-only social network called Moltbook.

Steinberger joined OpenAI in February to run its personal-agent push. OpenClaw itself did not join OpenAI. It moved into its own nonprofit, the OpenClaw Foundation, with OpenAI listed as one partner among Microsoft, GitHub, Nvidia, Atlassian, and Tencent. Independent, allegedly.

Why “accidentally” is the right word

The plan for this Openclaw update was actually kind of small and focused on simplifying installation and rebuilding the browser app. That’s it.

Then the team actually tried to do it properly, touching memory, models, plugins, messaging, and security. Before this release, OpenClaw had shipped 106 releases in 230 days—basically daily. Going seven weeks without shipping anything was, by their own admission, not normal.

They spent that extra time making sure existing installs wouldn’t break on upgrade, which is pretty normal if you have used Openclaw before. Hence the flashing warning in the release notes about backing up sessions before you touch the new SQLite storage.

So “accidental” is not a marketing line. It’s the team admitting scope creep in public. Two small fixes—onboarding, browser—pulled in everything else because everything else touched the same code they were already rewriting.

Hannes Rudolph, Openclaw’s Community Manager, frames it as OpenClaw eating its own dog food: once the team started running its own workflow through multiplayer sessions, the gaps in the old single-user design became too obvious to leave alone. So they didn’t. That’s how you get 16,000 pull requests instead of two.

What’s actually new

Setup now starts by checking what you already have—an existing Claude or ChatGPT subscription, an API key, a local Ollama model—before asking you to configure anything new. It tests if the model actually works before saving it, then dumps you straight into a real conversation instead of a settings screen nobody wanted to see.

The Control UI was rebuilt around chat instead of a separate overview dashboard, which puts it in the same visual family as ChatGPT, Claude, and Gemini. Files, Git diffs, pull-request status, a browser panel, and a terminal all live around the conversation now instead of forcing you to alt-tab through five different tools.

The team claims a simulated latency test cut initial JavaScript requests from 140 to 45 and startup time from 1.6 seconds to 575 milliseconds. Faster is faster; take the number for what it’s worth.

The multiplayer pitch

The headline feature is shared cloud sessions—an agent’s work becomes something a colleague can walk into mid-task without the context evaporating. Steinberger said on X that his own team ditched individual local coding harnesses for a shared setup at team.openclaw.ai, calling local harnesses “relics of the past.”

Security caught up to match. OpenClaw 2.0 adds request-specific approvals, command permissions scoped to specific arguments, more complex things include Docker and Podman sandboxing, role-enforced execution, and a team-scoped Secret Store that can slot a credential into a request without ever showing it to the model.

The catch: sandboxing and approvals are still off by default. OpenClaw’s own docs say one Gateway equals one trust domain, not a wall between people who don’t trust each other. If your company needs actual tenant isolation, you’re standing up separate Gateways—OpenClaw calls them “cells”—not flipping a switch.

The competition is heating up

OpenClaw hasn’t had the field to itself. Nous Research’s Hermes Agent, first tagged in March, built its whole pitch around not being OpenClaw: procedural memory that turns successful workflows into reusable skills automatically, and security defaults that don’t assume you’re the only person who’ll ever touch the machine.

OpenClaw splits a Gateway daemon from the agents it routes to. Hermes crams the conversation loop, tool dispatch, and memory into one agent class—messier to scale, simpler to reason about. The general verdict floating around all year: OpenClaw wins on ecosystem and channel breadth, Hermes wins on self-improvement and not shipping wide open by default.

OpenClaw 2.0’s new sandboxing narrows that gap. It doesn’t close it. The hardened settings still require someone to actually go turn them on.

How to get it

Existing users update through the normal CLI path. Read the fine print first—sessions created after the SQLite migration won’t show up if you downgrade later without a backup.

New users go through OpenClaw’s setup guide, now with guided onboarding across Mac, Windows, Linux, iPhone, iPad, and Android, plus staged imports for anyone jumping over from Claude, Codex, or Hermes itself.

It’s still free, still MIT-licensed, still living at github.com/openclaw/openclaw.