OpenClaw shipped version 2026.8.1 on August 31, 2026, and the project is calling it OpenClaw 2.0 — the biggest single update since the open-source AI assistant exploded onto GitHub in 2024. The release closes out a development cycle of nearly two months, a sharp break from the project’s usual cadence of shipping a new build every couple of days, and it lands with more than 16,000 pull requests folded into one build, according to SiliconANGLE.
For a project that built its reputation on speed, that pause is itself the story. OpenClaw, created by former PSPDFKit founder Peter Steinberger, went from a personal side project to one of the fastest-growing repositories GitHub has ever hosted, and it did so while drawing persistent criticism over the security risks of letting an AI agent touch a user’s files, browser sessions, and messaging apps. OpenClaw 2.0 is the project’s attempt to answer that criticism without slowing its growth.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Shipped in OpenClaw 2.0
OpenClaw 2.0, tagged as release v2026.8.1 on GitHub, was built by 933 contributors, including 569 people submitting a pull request for the first time, per SiliconANGLE’s reporting. The changes span installation, agent behavior, plugins, credential handling, browser control, messaging integrations, automation workflows, memory, and native desktop applications — building on incremental groundwork like version v2026.3.12, which added GPT-5.4 fast mode and a new gateway dashboard on March 13, 2026, per the OpenClaw changelog. That breadth reflects what OpenClaw has become since its 2024 debut: not a single tool but a self-hosted runtime that routes commands between chat apps like Discord, Slack, Telegram, WhatsApp, and Microsoft Teams and a user’s own AI models, whether cloud-hosted or run locally.
The project’s own framing, echoed across the release notes, is that OpenClaw needed “a stronger technical foundation and safer upgrade path” before it could keep adding features at the old pace. According to CyberSecurityNews, the update’s centerpiece is a security architecture aimed squarely at the agent’s biggest liability: giving an AI model standing access to a person’s tools, files, and accounts.
The Headline Security Fix: Credentials That Never Touch the Model
The feature getting the most attention from security reporters is how OpenClaw 2.0 handles secrets. In the new build, an agent can request a credential through a masked prompt, and the actual value of that secret never enters the chat transcript or the model’s context window, according to CyberSecurityNews and CyberPress. That distinction matters because most AI agent frameworks, including earlier OpenClaw builds, pass API keys, passwords, and tokens directly into the same context window the model reasons over — which means a prompt injection attack or a compromised plugin can potentially exfiltrate a credential simply by getting the model to repeat it back.
OpenClaw 2.0 also adds an opt-in proxy that restricts where a protected secret can be substituted, limiting it to destination hosts a user has explicitly approved. That protection builds on groundwork the project had already been laying for months: version v2026.3.2 expanded the underlying SecretRef system to cover 64 distinct credential targets on March 3, 2026, and version v2026.3.23 added SHA-256 CSP hashes along with new DashScope Qwen endpoints on March 23, 2026, according to the OpenClaw changelog. In practice, the 2.0 proxy means a credential tied to, say, a company Slack workspace can be blocked from ever being sent to an unapproved domain, even if a malicious skill or a manipulated prompt tries to redirect it.
The timing is not incidental. Security researchers have spent much of 2026 flagging OpenClaw’s exposure surface. A review of nearly 4,000 community-built skills found that 7.1% contained critical vulnerabilities, and more than 30,000 OpenClaw instances have been found exposed directly to the open internet, per security industry reporting. That sprawling plugin ecosystem has kept growing even as the security conversation intensified — version v2026.6.1 spun the project’s Tokenjuice component out into its own independent plugin on June 9, 2026, according to Fastio, adding yet another third-party-maintained piece to the attack surface. Firms including Cisco and BitSight have described the combination of broad system access and a sprawling, largely unaudited plugin ecosystem as a serious risk for casual users running the assistant without hardened configurations.
Collaboration Features Turn a Personal Tool Into a Team Tool
Security is not the only pillar of the release. OpenClaw 2.0 introduces shared cloud sessions, letting teammates join an in-progress agent session, pick up work where a colleague left off, and assign tasks to each other with the agent’s full working context intact. That is a notable shift for software that started as a single-user, self-hosted assistant living on one person’s machine. Turning it into something a team can co-drive pushes OpenClaw closer to the territory occupied by managed, enterprise-oriented agent platforms, while keeping the self-hosted, bring-your-own-model structure that drew its original user base.
Techgenyz reported that the release also focuses heavily on quality-of-life work: an easier installation flow, better persistence between sessions, and a rebuilt browser-control layer, alongside more options for configuring which agents handle which tasks. OpenClaw’s own documentation credits the August 2026 release with a rebuilt web experience and markedly stronger memory and session continuity, and MarkTechPost clocked the practical payoff at launch: the new Control UI was starting up in roughly 575 milliseconds as of August 30, 2026. Explainx.ai’s release coverage put a number on the underlying scale of the project by the time 2.0 shipped: more than 16,000 pull requests folded into the release and a substantially reworked user interface.
From Side Project to the Fastest-Growing Repo on GitHub
To understand why a single release is generating this much coverage, it helps to look at how fast OpenClaw got here. Most coverage traces the project’s public release to September 2024, though Wikipedia’s entry on the project separately dates a release under the earlier working name Warelay to November 24, 2025, before it was rebranded — reportedly through an interim “Clawdbot” identity — into the OpenClaw name it carries today. Its growth curve since has been unusual even by open-source AI standards. OpenClaw gained roughly 60,000 GitHub stars in a 72-hour window during an early viral spike, then kept climbing: it passed React’s star count and crossed 250,000 GitHub stars by March 2026, per tracking from Petronella Tech, before going on to cross 310,000 stars and 58,000 forks by April 2026, with more than 1,200 open-source contributors by that point, according to tracking from GitHub-adjacent analytics sites. At its peak, the project’s star velocity hit roughly 12,000 new stars per day — a pace that let it reach 250,000 stars about 18 months after launch, versus the eight years React needed to hit the same mark.
The community footprint scaled alongside the code: OpenClaw’s Discord server doubled to roughly 180,000 members, and the r/openclaw subreddit reportedly passed 450,000 members. On the enterprise side, one analytics firm found that 34% of its new enterprise customers in Q1 2026 were actively migrating away from managed agent services toward self-hosted OpenClaw deployments — a data point that helps explain why Anthropic, OpenAI, and other agent vendors have been watching the project closely rather than dismissing it as a hobbyist tool.
Why OpenClaw’s Creator Has Silicon Valley’s Attention
Peter Steinberger’s path to building one of GitHub’s fastest-growing projects runs through a prior exit: he founded PSPDFKit, a document-rendering SDK company, before turning to AI agent tooling. Coverage from Fortune and Fast Company has described him as having drawn direct interest from OpenAI’s Sam Altman and Meta’s Mark Zuckerberg as OpenClaw’s growth accelerated through early 2026, a level of attention unusual for a project that remains open-source and does not require users to route their data through any single company’s cloud.
That positioning — model-agnostic, self-hosted, bring-your-own-API-key — is central to why OpenClaw scaled the way it did. Unlike agent frameworks built tightly around one vendor’s API, OpenClaw lets users plug in cloud models from multiple providers or run models locally, with more than 100 preconfigured AgentSkills available for tasks like shell command execution, file management, and web automation. That model-agnostic promise keeps getting reinforced with each release: version v2026.7.1, shipped July 1, 2026, added support for GPT-5.6, Tencent’s Hy3, and Meta’s Muse Spark 1.1, according to OpenClaw’s own documentation. That flexibility is also the reason the security conversation around the project has been so loud: the same openness that lets OpenClaw reach into a user’s entire digital life is what makes a compromised skill or an exposed instance dangerous.
OpenClaw 2.0 Release Snapshot
| Metric | Figure | Source |
|---|---|---|
| Release version | v2026.8.1 (“OpenClaw 2.0”) | GitHub release page |
| Release date | August 31, 2026 | SiliconANGLE |
| Pull requests in this release | 16,000+ | SiliconANGLE / explainx.ai |
| Contributors to the release | 933 (569 first-time) | SiliconANGLE |
| Development cycle length | ~2 months (vs. 106 releases in 230 days previously) | SiliconANGLE |
| Community-built skills reviewed with critical flaws | 7.1% of ~4,000 skills | Security industry reporting |
| OpenClaw instances exposed to the open internet | 30,000+ | Security industry reporting |
OpenClaw vs. Claude Code vs. AutoGPT
OpenClaw’s closest points of comparison in 2026 are Anthropic’s Claude Code and the older AutoGPT framework, though the three occupy different niches. Claude Code is a terminal-based coding agent built and hosted by Anthropic, with security controls Anthropic manages directly and a scope that stays centered on code and command-line work rather than a user’s whole desktop. OpenClaw is broader by design: a general-purpose personal agent that can act across a user’s chat apps, browser, and file system, which is precisely why its security model has drawn more scrutiny. AutoGPT, meanwhile, was originally built around OpenAI’s API; it now supports other providers, but users report that non-OpenAI setups often require community forks or manual workarounds, unlike OpenClaw’s model-agnostic design from the outset.
| Factor | OpenClaw 2.0 | Claude Code | AutoGPT |
|---|---|---|---|
| Hosting model | Self-hosted, model-agnostic | Anthropic-hosted, Claude models | Self-hosted, OpenAI-centric |
| Primary scope | Full personal/desktop automation | Coding and terminal tasks | General autonomous task execution |
| Credential handling | Masked prompts, secrets kept out of model context (new in 2.0) | Managed by Anthropic’s own controls | Varies by community fork |
| Multi-user collaboration | Shared cloud sessions (new in 2.0) | Limited to individual sessions | Not a core feature |
| Reported security concerns | Prompt injection, exposed instances, vulnerable skills | Narrower attack surface by design | Fragmented, fork-dependent security |
Market Impact: Why Established AI Vendors Are Paying Attention
OpenClaw’s growth trajectory has become a genuine data point in how enterprise buyers think about AI agents. A project that reached 250,000 GitHub stars in roughly 18 months, against React’s eight years to the same milestone, is not just a curiosity for open-source watchers — it is evidence that a meaningful slice of developers and enterprises are willing to run agent infrastructure themselves rather than pay for a managed service. The reported 34% of one analytics firm’s new enterprise customers migrating from managed agents to self-hosted OpenClaw in Q1 2026 is a small sample, but it lines up with the broader trend of companies weighing data residency and cost control against the convenience of a vendor-managed agent.
That dynamic puts pressure on companies like Anthropic, OpenAI, and Google, all of which sell managed agent products that compete for the same automation budget OpenClaw is absorbing for free. It also puts pressure on OpenClaw itself: the more enterprise workloads route through it, the more its security posture becomes a liability that regulators, security vendors, and enterprise buyers will not let slide. OpenClaw 2.0’s credential-isolation feature reads as a direct response to that pressure — the kind of control an enterprise security team would require before signing off on production use, built and shipped by an open-source project rather than mandated externally.
Historical Context: An Unusually Fast Rise for Open-Source AI Tooling
Open-source projects have posted fast GitHub growth before, but OpenClaw’s curve stands out even against other AI-era breakouts. React needed roughly eight years to reach 250,000 stars; OpenClaw did it in about a year and a half. That kind of star velocity, peaking near 12,000 stars a day during its most viral stretch, reflects both the novelty of a genuinely capable personal AI agent and the low barrier to trying it: since OpenClaw is free, self-hosted, and works with API keys developers likely already have, the cost of experimentation was close to zero. The old cadence was still very much alive as recently as June 2026 — the OpenClaw Hub’s version history logs v2026.6.7 as a mid-year update shipped June 7, 2026 — which makes the project’s jump from that rapid-fire pattern of 106 releases in 230 days to a single, deliberately slower two-month cycle for version 2.0 all the more notable, marking the clearest sign yet that OpenClaw’s maintainers see stability and security debt, not feature velocity, as the bigger risk to the project’s future at this stage of its growth.
The Security Debate Is Not Settled
OpenClaw 2.0’s credential protections address one specific, serious failure mode, but they do not close every gap security researchers have raised. The 7.1% critical-vulnerability rate found across nearly 4,000 community skills points to a supply-chain-style problem: any user who installs a compromised or poorly written skill can still hand an agent broad access to their system, regardless of how well the core credential system is isolated. Likewise, the more than 30,000 instances found exposed to the open internet reflects a configuration and awareness problem more than a code problem — plenty of users are running OpenClaw with default or weak network settings, something no single release can fully fix.
Security researchers have generally welcomed the direction of OpenClaw 2.0’s changes while cautioning that a masked-credential system and an approved-hosts proxy reduce risk rather than eliminate it. Prompt injection remains an open research problem across the entire AI agent industry, not something any single vendor, open-source or commercial, has fully solved. For teams evaluating whether to expand OpenClaw usage, the sensible reading of this release is that it closes a real, previously well-documented hole, while the skill-ecosystem and exposed-instance risks require separate, ongoing mitigation — network hardening, skill auditing, and least-privilege configuration, not a version bump alone.
What Comes Next
A handful of things look likely to follow from this release, based on where OpenClaw’s growth, security posture, and competitive position stand today.
- Expect security vendors to publish updated audits of OpenClaw within weeks of the 2.0 release, testing whether the masked-credential system and host-restricted proxy actually hold up against real prompt injection attempts rather than just the threat model described in the release notes.
- Enterprise adoption is likely to accelerate further if the credential-isolation feature proves durable, since the lack of that exact control was the most commonly cited blocker for production use in prior enterprise reviews of OpenClaw.
- Managed agent vendors, including Anthropic and OpenAI, will likely respond with their own collaboration or credential-handling features, since OpenClaw’s shared cloud sessions directly target one of the few areas — team-based agent workflows — where hosted platforms still had a clear edge.
- The community skill ecosystem will remain OpenClaw’s biggest unresolved risk; expect calls for a formal skill-review or signing process to grow louder given the 7.1% critical-vulnerability figure already in circulation.
- Slower, more deliberate release cycles are likely to become the new normal for OpenClaw rather than a one-off pause, since the project’s own framing of this cycle was about building a “safer upgrade path,” language that implies an ongoing shift in priorities rather than a single course correction.
How OpenClaw 2.0 Compares to the Project’s Own History
| Period | Milestone |
|---|---|
| September 2024 | OpenClaw’s public release |
| Early viral spike | ~60,000 GitHub stars gained in 72 hours |
| March 2026 | Surpasses React’s all-time GitHub star count |
| April 2026 | Crosses 310,000 stars and 58,000 forks, 1,200+ contributors |
| Q1 2026 | 34% of one analytics firm’s new enterprise customers migrate to self-hosted OpenClaw |
| August 31, 2026 | OpenClaw 2.0 (v2026.8.1) ships with credential isolation and shared sessions |
What This Means for Developers Deciding Whether to Adopt OpenClaw
For developers weighing OpenClaw against a managed alternative, the calculus shifts meaningfully with this release, but it doesn’t disappear. The self-hosted, model-agnostic structure that made OpenClaw attractive in the first place still means the user, not a vendor, carries responsibility for network exposure, skill vetting, and update hygiene. What changes with 2.0 is that the single biggest structural risk — secrets living inside a model’s context window, available to be leaked through a manipulated prompt — has a documented fix. Teams running sensitive workloads through OpenClaw should treat the update as a reason to re-run their own security review rather than an automatic green light, especially given that the exposed-instance and vulnerable-skill numbers cited by security researchers predate this release and have not yet been independently retested against it.
The practical decision points for most teams remain the same three questions they were before 2.0: does the workload need the breadth of access OpenClaw provides, is there internal capacity to audit third-party skills before installing them, and is the network configuration locked down well enough that an exposed instance isn’t a realistic risk. OpenClaw 2.0 makes a strong case on the first structural risk. It does not answer the other two for you.
Frequently Asked Questions
What is OpenClaw 2.0?
OpenClaw 2.0 is the version 2026.8.1 release of OpenClaw, an open-source, self-hosted personal AI agent created by Peter Steinberger. It shipped on August 31, 2026, and is described by the project as its biggest update since its 2024 launch, folding in more than 16,000 pull requests from 933 contributors.
What is the biggest new feature in OpenClaw 2.0?
The most-covered feature is credential isolation: agents can now request secrets through a masked prompt so the actual value never enters the chat transcript or the model’s context window, plus an opt-in proxy that restricts where those secrets can be sent.
Is OpenClaw free and open-source?
Yes. OpenClaw is a self-hosted, model-agnostic project that lets users bring their own API keys for cloud AI models or run models locally, and its source code is publicly available on GitHub.
Who created OpenClaw?
OpenClaw was created by Peter Steinberger, previously the founder of document-rendering SDK company PSPDFKit, according to reporting from Fortune and Fast Company.
How does OpenClaw compare to Claude Code?
Claude Code is Anthropic’s hosted, terminal-focused coding agent with a narrower scope and security controls managed directly by Anthropic. OpenClaw is broader and self-hosted, built for general personal and desktop automation across chat apps, browsers, and file systems, which is also why it carries a wider security surface.
Is OpenClaw safe to use?
OpenClaw 2.0’s credential-isolation system addresses a major previously documented risk, but security researchers have flagged that thousands of OpenClaw instances remain exposed to the open internet and that a portion of community-built skills contain critical vulnerabilities. Users should still follow network hardening and skill-vetting practices rather than relying on the update alone.
How fast has OpenClaw grown since launch?
OpenClaw reached roughly 250,000 GitHub stars about 18 months after its September 2024 release, a pace that let it surpass React’s all-time star count, which took React about eight years to reach.
Does OpenClaw 2.0 support team collaboration?
Yes. The release adds shared cloud sessions, letting multiple team members join an ongoing agent session, pick up work with full context, and assign tasks to each other in real time — a shift from OpenClaw’s original single-user design.
Related Coverage
- Why Anthropic's August Was Different From Every Prior Month
- What Is a Password, and Why Is It Still Everywhere?
- The Quick Answer: Steam vs Xbox vs PlayStation Family Tools at a Glance
- RTX 5070 Ti vs RX 9070 XT: The Quick Answer
- What Is an AI Avatar Generator, and Why Are There So Many Now?
