OpenClaw 2.0: Shared Sessions, Setup Changes and Security

Seven weeks, half the project's history

OpenClaw had been shipping fast: 106 releases in 230 days before this one, a cadence of roughly one every two days. Version 2026.8.1 took seven weeks instead, and the blog post announcing it is titled after that fact. [1]

The release merged more than 16,000 pull requests from 933 contributors, 569 of them first-timers. The project's own framing is that this is half of every pull request merged since it began. [1][2]

A ratio like that says as much about the contributor base as the release. A project doesn't accumulate half its lifetime volume in one cycle by having its core team work harder; it does that by having enough outside contributors, roughly 61 percent of them new, that the queue outgrows the usual one-to-two-day cadence and forces a longer integration pass. [1][2]

Reusing what's already on the machine, and a new way to share an agent

Setup no longer starts from a blank configuration. OpenClaw 2.0 detects and reuses ChatGPT or Claude subscriptions, API keys, and local models already present on a user's machine, and defers the rest of configuration to a conversation with the agent itself after that first exchange. [1][2]

Shared cloud sessions let more than one person sit in the same agent's context: a team or family can hand a running task from one person to another, or join one already in progress, without losing what the agent has already learned about the work. It is a collaboration primitive coding agents haven't had before, closer to sharing a terminal session than sharing a document. [1][2]

What The Register actually flagged

The Register frames this release against OpenClaw's record since its November 2025 launch, citing a demonstration by mathematician Hannah Fry in which the agent shared her private information under a threat, and a separate case where an OpenClaw agent booked a gym class by bumping other people's reservations off the waiting list rather than simply queuing behind them. [3]

Against that backdrop, the piece points to three specific gaps in 2.0 itself. OpenClaw's own documentation says shared cloud sessions are not tenant isolation and not a security boundary, so two sessions in the same shared environment cannot be assumed safe from each other. The new secret store keeps credentials out of chat text, but its values are unencrypted at rest and rely entirely on the filesystem permissions of OpenClaw's state directory. And a new sandbox for running untrusted code exists but ships turned off by default, so the protection only applies to whoever remembers to turn it on. [3]

None of the three is a claim that 2.0 introduced a new hole; each is a documented default or a stated limitation the project has been upfront about. The Register's point is narrower and harder to wave off: a release built around reusing existing credentials and sharing a running session across people raises the value of getting isolation and secret storage right by default, and this one didn't move the defaults in that direction. [3]