OpenClaw 2.0 shipped half of everything the project has ever merged — after seven weeks of not shipping at all

For 230 days, OpenClaw shipped a release roughly every other day — 106 of them, most landing within a day or two of the one before. Then, in mid-July 2026, it stopped. For 49 days the open-source AI agent with 388,419 GitHub stars published nothing at all.

On August 31, 2026 it published v2026.8.1, and the release contained more than 16,000 merged pull requests from 933 contributors, 569 of whom had never contributed before. By the project's own accounting, that single release carries roughly 50% of every pull request ever merged into OpenClaw.

The pattern is hard to miss, and it is not really about one project. Over the past eighteen months the model layer went open — weights you can download, licences you can read, prices that collapsed. What OpenClaw 2.0 marks is the same thing happening one level up, at the layer that decides what a model is allowed to touch. This post is a close read of that release: the velocity numbers and what they actually measure, the "bring your own model" setup that imports the subscription you already pay for, the multiplayer feature that tries to solve context handoff, the migration that can break your existing install, and the security defaults that are still switched off. It is the sequel to our pieces on the stealth model that turned out to be GLM-5.3-Flash and the 27B download that outscored February's best closed model — same argument, one abstraction layer higher.

TL;DR:

• The volume is verified and enormous. 16,000+ PRs, 933 contributors, 569 first-time, in one release published August 31, 2026 — roughly half of the project's all-time merged total, after 49 days without a release.
• "AI you own" now has a concrete meaning. Guided setup reuses an existing Codex, ChatGPT or Claude CLI sign-in, a pasted API key, a fresh provider sign-in, or an installed Ollama / LM Studio model — and proves the choice can answer before saving it.
• This is the maturity turn, and it costs something. Sessions and transcripts moved into SQLite; HEARTBEAT.md is no longer read at runtime; the plugin SDK's deactivate alias is gone; and rolling back across the migration requires the current CLI to restore archived legacy artifacts first.
• Better security is not the same as secure defaults. Sandboxing and execution approvals ship off, the Secret Store is not encrypted at rest, and shared sessions are documented as not a security boundary.

Cadence and contents of the 2.0 cycle. Figures from the project's release notes and blog post, August 31, 2026.

Sixteen thousand pull requests is a claim about people, not code

Start with what the number is not. Sixteen thousand merged PRs is not sixteen thousand features, and anyone who has watched an active repository knows most of that volume is documentation fixes, dependency bumps, test hardening and one-line corrections. The release notes bear this out: entire subsections are lists of entries like "Correct the onboarding setup command" and "Remove underlines from dashboard session cards."

What the number is measuring is participation, and that is the more interesting quantity. 933 people contributed to this release and 569 of them had never contributed to OpenClaw before — a 61% first-timer rate. That ratio is what a project looks like when its contributor base is still expanding rather than consolidating around a core team.

The trajectory around it is steeper than the release itself. Wikipedia records the project at 247,000 stars and 47,700 forks as of March 2, 2026. When we queried the GitHub API on September 1, 2026, the same repository returned 388,419 stars and 81,534 forks — an increase of roughly 141,000 stars and 34,000 forks in six months, on a repository that did not exist before November 24, 2025.

March figures via Wikipedia's OpenClaw article; September figures retrieved directly from the GitHub REST API on September 1, 2026. Star counts are a popularity signal, not a usage measurement.

That last caveat matters. Stars are the cheapest possible endorsement — a bookmark, not an install. We quote them because the delta is informative about attention, not because 388,419 people are running an agent on their laptop.

Here is the point, and we will mark the pivot clearly. Everything above is measurement; what follows is our read of it. The reason this release is worth an article is that the open-source AI story has, until now, been almost entirely a story about weights. Labs published models; everything that decided what those models could do — read your email, click a button, message your brother — stayed inside somebody's closed product. A 933-person release at the harness layer is the first strong evidence that the agent layer is following the model layer into the open, and it is following faster than the model layer did.

Why the fast project deliberately stopped being fast

The seven-week gap is the most quotable thing in this release and the least discussed.

The team's explanation is unusually direct. In their release post, they write that the cadence slowed while development accelerated: "our team was growing, and the increased volume and pace of work outgrew both the foundation of OpenClaw and the process we used to ship it, so we reworked both at the same time." The extra weeks went into making the release survive contact with existing installs rather than only fresh ones.

Read that against the 106-releases-in-230-days number and you get a portrait of a specific transition. Shipping every other day is what a project does when the cost of a bad release is low, because almost nobody's setup is load-bearing yet. Pausing for 49 days to write a migration path is what a project does when that stops being true.

We would call this the infrastructure turn: the moment a fast-moving tool acquires enough real users that "move fast" and "do not break the thing people rely on" stop being compatible, and the project has to pick. OpenClaw picked, publicly, and the release notes carry the receipts — a storage-and-downgrade warning at the top of the installation section, a documented backup procedure, and openclaw doctor --fix migrations for two separate subsystems.

One small piece of evidence that the process is still catching up: the release notes open with a warning that a package published as 2026.9.1-beta.1 was incorrectly versioned and is actually 2026.8.1-beta.4, and should not be treated as newer than stable 2026.8.1. A versioning mistake serious enough to need a banner is exactly the kind of thing the infrastructure turn is supposed to eliminate. It has not, yet.

"AI you own" starts at the setup screen, and that is not a small thing

The phrase "AI you own" gets used loosely. In this release it has a specific, checkable meaning: the first thing the installer does is look for AI access you already have, rather than asking you to buy more.

Guided setup accepts four sources, in the same run:

1. An existing verified CLI sign-in — Codex, ChatGPT, or Claude. If you already pay for a consumer subscription, the agent can use it.
2. A pasted API key, for anyone who would rather meter usage directly.
3. A fresh provider sign-in, for people with neither. New OpenAI setups default to GPT-5.6.
4. Locally installed models — the setup scans for Ollama and LM Studio installations already on the machine.

Then it does the step that most onboarding flows skip: it proves the selected model can actually answer before saving that model and credential. Anyone who has spent twenty minutes discovering that a saved API key was scoped to the wrong project will recognise what that check is worth.

The local path got structural work too. node-llama-cpp was replaced with a managed llama-server, Gemma 4 became the RAM-gated llama.cpp default, and the llama.cpp default context window was raised to 64K. That last number is the one to hold onto: 64K tokens of default local context is roughly a 90-minute meeting transcript, on hardware you own, with no per-token bill.

Guided setup's four accepted sources and the verification gate. Source: v2026.8.1 release notes, August 31, 2026.

Now contrast the shape of that with the closed assistant ecosystems most people actually use, because the contrast is the argument.

Structural comparison, not a quality comparison. Closed products are frequently better polished; the column that matters here is the last row.

That last row is the whole thesis. In the closed column, the model, the interface, the storage and the extension policy are bundled into a single decision you make once and cannot unbundle. In the open column they are four separate decisions. Nothing about that guarantees a better product — it guarantees a different failure mode. When a closed assistant raises prices or deprecates a feature, you have no move. When your own agent's model gets expensive, you change one setting.

Messenger-first is a design bet, not a convenience feature

Most AI products put themselves in a new app and hope you visit. OpenClaw's core bet, from its earliest version, is the opposite: the agent lives in the messaging apps you already have open.

This release deepens that considerably. Telegram gained richer messages and media. Slack now keeps live progress and the final answer together in one place. Discord added opt-in Activities and voice rooms that understand who is present. Signal replies keep their native quote block through ordinary, chunked, media and durable delivery, and messages received just before a crash can now resume from local storage. Across supported channels, eligible single-choice questions render as native platform controls on Telegram, Discord and Slack rather than as "reply with 1, 2 or 3."

There is a reliability story underneath the polish that we think is the more meaningful change. When a send times out without a confirmed result, OpenClaw now keeps that outcome marked uncertain and can warn you on the next contact rather than creating a likely duplicate. Anyone who has built messaging integrations knows how much unglamorous work sits behind that sentence, and how bad the alternative feels — an agent that messages your colleague the same thing twice because a socket hiccuped.

The team's own illustration of what this is for is deliberately unimpressive, and that is why it lands. From their release post: have the agent watch your inbox for your kids' school emails and send you a Telegram message when something important arrives — homework due, an activity to prepare for. One inbox, a few things to look for, one destination. Their second example goes a step further: your brother sends an iMessage asking which iPad you bought for your dad, and instead of searching your email for the receipt, you tell your Claw that your brother messaged and ask it to find the answer and send it to him.

Neither example involves a benchmark. Both involve an agent holding a credential you gave it, reading something you own, and writing to a person you chose. That is the actual product category, and it is closer to "a script with a memory and a phone number" than to "a chatbot."

Multiplayer AI: the hard part was never the screen, it was the context

The headline collaboration feature in 2.0 is shared cloud sessions, and the team is candid that it came from their own pain. Building this release, they moved more of the work onto their agents, then wanted to split tasks, collaborate, and sometimes hand them off entirely — and found that "OpenClaw had no way to bring another team member into the work without losing what the Claw already knew."

That sentence names a problem far bigger than OpenClaw. Call it the handoff cliff: the point where work moves from one person to another, and everything the tool had accumulated — the false starts, the corrections, the thing you told it not to do twice — falls off the edge. The replacement is a summary, and a summary is not context. It is a compressed artifact that preserves conclusions and discards the reasoning that made them safe.

Shared cloud sessions attack that directly. A second person can join live work or take it over with context intact, and the owner or an administrator chooses which of four levels that person gets: read, suggest changes, work in a draft, or participate directly. Drafts can be created and published without a race, suggestions keep their author, and lightweight presence and typing cues show who is in the room without cluttering a solo setup.

Creator Peter Steinberger wrote on X early on August 31, 2026 that the team spent two months on a mission to "build OpenClaw with OpenClaw," moving off individual local coding harnesses and onto a shared agent environment at team.openclaw.ai. "Multiplayer coding + infinite compute with nodes and cloud sessions has been a game changer for how we build," he wrote, adding that local harnesses now "feel like relics of the past." That is a founder describing his own product, so weight it accordingly — but the release exists, and it was built that way.

The handoff cliff and what shared sessions change. The documented limit is printed in the diagram deliberately.

Now the honest limit, which the documentation states plainly and which most coverage buried: these permission levels are not tenant isolation and not a security boundary. Revoked access can briefly appear to still work until the UI refreshes or the Gateway rejects the action. Incognito mode is narrower than its name suggests — the conversation lives in process memory and disappears when the Gateway restarts, but the model provider still receives every message, tools can still write files and reach external services, content-free audit metadata remains, and whoever operates the Gateway can watch the work live. Help Net Security added a detail worth knowing before you deploy this on a shared machine: the faster startup relies on a bounded transcript snapshot stored unencrypted in the browser profile.

The browser app went from afterthought to the place you actually work

The rebuilt Control UI is where most of the visible engineering went, and it comes with the only clean performance number in the release.

In a simulated default-chat test against a mocked Gateway with 50 ms HTTP/1.1 latency, JavaScript requests fell from 140 to 45 and startup fell from roughly 1.6 seconds to 575 milliseconds — a 64% reduction in requests and a 2.8x improvement in time-to-chat. It also degrades less over a long session: hidden panels stop fetching data they do not display, retained state is bounded, and returning to a conversation repeats less rendering.

Around the chat, docked panels now hold a workspace file editor, a git-backed Changes panel showing branch commits, working-tree edits, pull-request status and CI summaries, a browser panel that can navigate, click, type, scroll, inspect elements and annotate a screenshot before attaching it to the conversation, and a full-screen web terminal. Approval requests appear inside the conversation that triggered them, with a rolling 30-day history, and a /btw command opens a side conversation so a quick question does not pollute the main transcript.

The release notes are refreshingly blunt about where the panels stop: the file editor cannot create or delete files, the Changes panel is read-only, and "Create PR" hands off to GitHub rather than submitting from inside OpenClaw. We have read a lot of release notes that would have described those three limits as "focused" or "streamlined." Stating them as limits is the correct call and a small credibility deposit.

Sessions moved to SQLite, and that is where the breaking changes live

This is the section to read before you type openclaw update.

Sessions and transcripts are no longer file-backed; they live in SQLite. So do a long list of other things that used to be scattered: node-host identity and Gateway settings, APNs registrations, workspace setup state, channel runtime state, MCP OAuth credentials and refresh state, Reef peer trust, and bounded BLOB storage for trusted plugins. The default session archive disk budget was raised to 10 GiB. On web, macOS, iOS and Android, SQLite-backed chats can now rewind to an earlier user message, fork the conversation and switch between preserved branches — though rewinding changes only the transcript branch and does not undo files, sent messages, or other tool side effects.

The cost is that downgrades are no longer free. Here is the procedure the release notes specify, in order:

1. Create a verified backup before upgrading, using the documented backup path, to protect broader OpenClaw state — not just sessions.
2. Upgrade with openclaw update, which detects your install type (npm, pnpm, Bun, or git), fetches the version, runs openclaw doctor, and restarts a managed Gateway service. Use --dry-run first to preview.
3. If you use QMD memory, run openclaw doctor --fix. Built-in Memory now owns the core search and recall path; the migration carries supported data into a different core, and QMD-only reranking, query expansion and cross-agent transcript search are retired.
4. If you use HEARTBEAT.md, run openclaw doctor --fix. Heartbeat schedules are now managed as Automations, and OpenClaw no longer reads HEARTBEAT.md at runtime.
5. If you ever need to roll back, use the current CLI to restore archived legacy transcript artifacts before installing an older file-backed release. Sessions created after the migration will not appear in older releases at all.

Plugin authors have their own list. Retired July and August SDK paths are removed, the deactivate alias is replaced by gateway_stop, and clients using the v2026.7.2 beta question, worker, or session-catalog shapes must move to the renamed and flattened contracts. The beta.5 session-store bridge remains available through October 12, 2026 — a real, dated deprecation window, which is more courtesy than most fast-moving projects extend. Custom agents.defaults.cliBackends commands, arguments, environment, aliases and parsers now belong in a backend plugin rather than in configuration. And managed worktrees now suppress repository Git hooks unless an administrator deliberately runs a separate setup script, so any repo that relied on implicit hooks needs that setup moved into the explicit path.

None of these are catastrophic. All of them are the kind of thing that turns a two-minute update into a two-hour evening if you find out afterwards.

Security got substantially better and is still not on by default

This is the part where enthusiasm has to be disciplined, because an agent that can read your email and run commands is a different risk object than a chatbot.

The genuine improvements are real and specific. A new team-scoped local Secret Store separates Protected values from Agent-readable environment values, supporting masked credential requests, Vault or 1Password references, and destination-bound substitution that can place a protected credential into an approved Gateway-hosted HTTPS request without it ever appearing in plaintext configuration or model-visible text. Private credential requests let an agent ask for a secret through a masked prompt without the value entering the chat history or the model context. Network policy now blocks unspecified and local-use NAT64 targets by default and requires an exact-host exception for private automation webhook destinations. Text returned by search, fetch, MCP, plugins and the Browser tool is bounded, normalized and explicitly marked as untrusted external content before the model sees it. Terminal and CSV output neutralize covered control-sequence and formula-injection forms. The Gateway binds to loopback by default, most chat channels answer an unknown DM sender with a pairing code, and there is now an openclaw security audit command that checks inbound access, tool blast radius, network exposure, browser control exposure and plugin allowlists.

Now the caveats, each of which comes from the project's own documentation rather than from a critic.

Secret Store values are not encrypted at rest. They depend on the filesystem permissions of OpenClaw's state directory. Destination-bound substitution applies only to Gateway-hosted HTTPS commands whose subprocess honours proxy settings — raw sockets, containers, remote nodes, provider-native harnesses and plain HTTP fall outside it.

Marking content as untrusted does not make it harmless. The release notes say so directly: the boundary is made explicit, but "the model can still be influenced by hostile material it reads."

Sandboxing and execution approvals ship off. VentureBeat's read of the enterprise posture is the sharpest summary available: OpenClaw's baseline configuration assumes a trusted single operator and permits host execution unless administrators configure stronger restrictions, which is why container-first alternatives such as NanoClaw exist. Their conclusion is worth quoting exactly: "enterprises have to turn those primitives into policy. OpenClaw 2.0 doesn't automatically make OpenClaw enterprise-ready, but it does make an enterprise-grade OpenClaw deployment far easier out-of-the-box."

On prompt injection specifically, OpenClaw's own documentation treats model choice as the first mitigation and cites a 2026 crowdsourced arena of 272,000 attacks across 41 agent scenarios, scored only when the agent both executed the harmful action and hid it from the user: 0.5% success against Claude Opus 4.5, 1.0% against Sonnet 4.5, 1.3% against Haiku 4.5, and 8.5% against Gemini 2.5 Pro. The same page warns that adaptive human attackers still exceed 80% success against state-of-the-art defences, which is why tool policy, exec approvals and sandboxing remain the hard enforcement layer rather than the model.

Put those two figures side by side and you have the honest state of agent security in 2026: automated injection at scale is now a sub-2% problem against a good model, and a determined human is still an 80% problem against everything. Nothing in this release changes the second number.

Compiled from the v2026.8.1 release notes and OpenClaw's security documentation, retrieved September 1, 2026.

What actually changes for someone who is not a developer

Strip out the plugin contracts and the SQLite migration and one thing is left that matters to ordinary users: install friction went down a lot. If you want to walk that path yourself, we wrote a step-by-step beginner setup guide covering the whole route from download to first conversation.

The supported install path now keeps the app or command available after setup. A Mac app opened from Downloads can offer to move itself into Applications, where updates and launch-at-login work properly. On Linux and other Unix systems, the installer makes openclaw available in new terminal sessions without asking anyone to edit a shell startup file. iPhone, iPad and Android put pairing and permissions where people expect them. And there is now a Linux desktop companion with first-run setup, tray and service controls, an embedded Control UI, deep links, autostart and native alerts — though the release notes themselves flag that the availability of its .deb and AppImage packages as v2026.8.1 downloads "has not yet been verified."

Automations got the same treatment. The bundled IMAP watcher lets authenticated new mail from an existing mailbox start a restricted reader agent without exposing an HTTP hook — it is disabled by default, inbound-only, requires sender allowlisting and authentication, and cannot send or modify mail. That is the school-email example from the release post, shipped as a bounded, least-privilege primitive rather than a "connect your Gmail" button. Gmail automations can now split an accepted batch into one isolated run per message and filter Sent and Draft mail.

We will still not pretend this is a consumer product. One of OpenClaw's own maintainers has been quoted saying that if you do not understand how to run a command line, the project is far too dangerous for you to use safely, and in March 2026 Chinese authorities restricted state-owned enterprises and government agencies from running OpenClaw apps on office computers over security concerns. Those facts are on the record and this release does not erase them. What it does is move the floor: the gap between "curious person" and "working agent" is now measured in a guided setup rather than in a configuration file.

Four things we could not verify

The claim that the release "touches every part of OpenClaw" is the team's own framing, and while the release notes do span installation, messaging, memory, skills, models, automations, browser and native apps, plugins and security, we have no independent audit of the 16,000-PR figure or the 933-contributor count. Both come from the project itself.

Sources disagree on the release date. Wikipedia's infobox lists the stable 2.0 release as August 30, 2026, MarkTechPost published its coverage dated August 30, and the GitHub release object for tag v2026.8.1 records a publication timestamp of 2026-08-31 03:30 UTC. We have used August 31 throughout because it is the first-party artifact; if you see August 30 elsewhere, that is the discrepancy.

The licence field is inconsistent. Wikipedia lists OpenClaw as MIT-licensed; the GitHub API returns NOASSERTION for the repository's licence, which is what GitHub reports when its detector cannot classify the file. We have not resolved which is authoritative and would not build a compliance decision on either without reading the licence file directly.

Steinberger's characterisation of the internal workflow — "infinite compute," local harnesses as "relics of the past" — is a founder's description of his own product on his own timeline, posted August 31, 2026. We quote it because it explains the feature's origin, not because it is an evaluation.

The bottom line: open-source AI stopped being a story about weights

For two years, "open AI" meant a file you could download. The interesting question was always what happens one layer up — whether the part that holds your credentials, reads your inbox and decides what to do next would also be something you could inspect, fork and run yourself, or whether it would stay inside somebody's product where the model choice, the interface and the storage are bundled into a single take-it-or-leave-it decision.

A release with 933 contributors, a setup wizard that reads your existing subscriptions, a local-model path with 64K of default context, and a documented downgrade procedure is what the answer looks like when it goes the other way. It is not a polished answer. Sandboxing is off, secrets are unencrypted at rest, sharing is explicitly not a security boundary, and a determined attacker still wins four times out of five. But those are now published limitations with issue numbers attached, which is a categorically different situation from not knowing.

The handoff cliff is the part we would watch next. Shared cloud sessions are the first serious attempt we have seen to make an agent's accumulated context survive a change of operator, and the fact that a 933-person open-source project reached that problem before most closed assistants did tells you where the real frontier is. It is not capability. It is continuity.

---

Where Telli.sh fits: the handoff cliff is not unique to agents — it is the oldest problem in meetings. The hour of context that lived in the room evaporates, and what reaches the person who missed it is a summary that preserved the conclusions and lost the reasoning. Telli.sh records the meeting, keeps the speakers apart, translates live across 15 languages, and leaves behind a searchable transcript and structured notes, so the handoff carries the actual record instead of somebody's compressed memory of it.

Start a live AI note

Sources

• OpenClaw release notes, v2026.8.1 (AKA OpenClaw 2.0) — the mistaken 2026.9.1-beta.1 beta publication warning, the SQLite storage and downgrade warning, guided setup, Control UI latency figures, Secret Store behaviour, messaging changes, the plugin SDK contract cleanup and the October 12, 2026 bridge window; retrieved September 1, 2026
• OpenClaw blog, "OpenClaw 2.0, Accidentally," August 31, 2026 — 933 contributors, 569 first-time, 16,000+ pull requests, 106 releases in 230 days, the ~50% of all-time PRs figure, and the school-email and iPad-receipt examples
• MarkTechPost, "OpenClaw Releases OpenClaw 2.0," August 30, 2026 — the 575 ms startup and 140→45 request figures, the Codex/ChatGPT/Claude/Ollama/LM Studio setup sources, GPT-5.6 default, Gemma 4 and the 64K llama.cpp context, and the 272,000-attack prompt-injection arena results
• Help Net Security, "The OpenClaw 2.0 release moves your sessions into SQLite," August 31, 2026 — the sharing-is-not-a-security-boundary framing, Incognito's real scope, and the unencrypted browser-profile transcript snapshot
• Cybersecurity News, "OpenClaw 2.0 Released With Major Security Upgrades for AI Agents, Plugins and Credentials," August 31, 2026 — private credential requests via masked prompt, the opt-in destination-restricting proxy, and the shared credential store for teams
• VentureBeat, "OpenClaw 2.0 is here: What it means for enterprises," September 1, 2026 — sandboxing and execution approvals off by default, the NanoClaw comparison, the expanded auditing surface, and the "primitives into policy" conclusion; includes the Steinberger X post of August 31, 2026
• OpenClaw documentation, Cloud Sessions — how a shared session preserves the transcript and context across a handoff
• OpenClaw documentation, Updating — openclaw update behaviour, the --dry-run flag, release channels, and the downgrade path across the session SQLite migration
• GitHub REST API, openclaw/openclaw — 388,419 stars, 81,534 forks, 5,949 open issues, repository created November 24, 2025, and the v2026.8.1 release timestamp of 2026-08-31 03:30 UTC; retrieved September 1, 2026
• Wikipedia, "OpenClaw" — the Warelay → CLAWDIS → Clawdbot → Moltbot → OpenClaw naming history, the Anthropic trademark complaint, the March 2, 2026 star and fork counts, the maintainer's command-line warning, and the March 2026 Chinese government restrictions; retrieved September 1, 2026
• Our post on the Ox Alpha stealth model and GLM-5.3-Flash — the open-weights price collapse this release sits on top of
• Our before-and-after on the local-model comeback — the 27B open-weight figures and the catch-up lag