Technical personal automation
People who want one self-hosted assistant across messages, email, calendar, files, browser tasks and scheduled workflows.
Independent tool overview
Openclaw 2.0 at a glance
OpenClaw 2.0 is the August 2026 release of the open-source personal-agent gateway, tagged v2026.8.1. It makes first use substantially easier by detecting existing ChatGPT, Claude, API-key and local-model access, trimming initial configuration and rebuilding the browser Control UI around immediate conversation. It also turns team use into a first-class experience: shared sessions carry creator, owner, participant and live-presence information so trusted teammates can watch, steer and hand off work with context intact. The software is free under the MIT license, but users still pay for model subscriptions or API tokens, always-on hardware, cloud workers and connected services. OpenClaw can access email, calendars, files, browsers, messaging channels and shell tools, so its value and danger come from the same delegated authority. Run one Gateway per trust boundary, keep it off the public internet, isolate each external sender's session, use least-privilege tools and dedicated accounts, audit every configuration change and require confirmation before sending, purchasing, deleting, deploying or creating commitments.
Visit the official Openclaw 2.0 site ↗
- Current release
- v2026.8.1, also called OpenClaw 2.0
- Release date
- August 30, 2026
- Software license
- MIT
- Software price
- Free
- Platforms
- macOS, Linux and Windows
- Recommended Node
- Node.js 26; supported older ranges documented
- Primary interface
- Browser Control UI plus chat channels and native companions
- Model choice
- Hosted subscriptions, API keys or local models
- Team model
- Multi-user sessions inside one trusted Gateway boundary
- Default host bind
- Loopback on regular installs
- Security check
- openclaw security audit --deep
- Reviewed
- August 31, 2026
Overview
What Openclaw 2.0 is
OpenClaw 2.0 is the name used for release v2026.8.1, published August 30, 2026, and described by the project as its largest update.
OpenClaw is an open-source, self-hosted Gateway that connects AI models to chat channels, memories, skills, automations, browsers, computers and local or remote tools.
Version 2.0 simplifies onboarding by detecting AI access already present on the computer, including ChatGPT or Claude subscriptions, API keys and local models, then proving inference with a real completion.
The browser app was rebuilt as a first-class Control UI where users can start a conversation, finish setup, return to work and observe a running agent.
Multi-user mode adds immutable session creator, assignable owner, participant history, live presence and filters. Trusted teammates can continue or take over a session without copying its context.
Shared-session ownership and avatars are collaboration features, not security isolation. Everyone able to operate an agent can exercise that agent's delegated authority.
Cloud Sessions can execute coding work on the Gateway, a paired machine or disposable cloud worker while the Gateway retains the transcript, credentials, placement history and reconciled worktree.
OpenClaw supports many hosted providers as well as local inference through options such as Ollama, LM Studio, llama.cpp, vLLM and SGLang. Running the Gateway locally does not make a hosted model's inference local.
Its messaging surfaces include major services such as WhatsApp, Telegram, Signal, Slack, Discord, Google Chat, Microsoft Teams, iMessage, Matrix and others through bundled or plugin channels.
Normal host installs bind the Gateway to loopback and unknown direct-message senders receive pairing challenges by default. Some containers or workspace channels have different defaults and must be reviewed.
OpenClaw stores sensitive tokens, provider profiles, channel credentials, MCP OAuth sessions, memory and runtime state under its local state directory. Protect that host with encryption, restricted permissions and a dedicated operating-system user.
The model can be manipulated by untrusted email, webpages, documents and messages. OpenClaw's own security guidance says to assume model manipulation and limit blast radius rather than trust the model to resist every injection.
Use cases
Who Openclaw 2.0 is best for
The strongest fit depends on the job you need the product to complete, not the size of its feature list.
Trusted small teams
Teams whose members share one security boundary and need to observe, steer, assign and hand off live agent sessions.
Model-flexible deployments
Users who want to switch among subscriptions, API providers and local models without changing the entire assistant layer.
Always-on home or work agents
Dedicated Mac mini, Linux server, VPS or Windows Hub installations that can run scheduled and messaging workflows continuously.
Remote coding sessions
Developers dispatching work to paired build machines or disposable cloud workers while retaining one session and transcript.
Extensible agent builders
Technical users prepared to inspect and maintain plugins, skills, channel integrations and custom workflows.
Capabilities
Core Openclaw 2.0 features
Simplified guided onboarding
Detects existing model access, verifies it with a real response and defers nonessential configuration until after the first conversation.
Rebuilt browser Control UI
Centers setup, chat, session history, live work and administrative controls in a first-class web experience.
Multi-user sessions
Tracks creator, owner, participants and live presence and supports view, suggestion and write collaboration modes.
Session handoff
Lets another trusted operator or an authenticated terminal continue existing work with Gateway-owned context.
Multi-channel messaging
Connects one agent to common personal and workplace chat surfaces with sender, group and mention policies.
Persistent memory and skills
Keeps customizable workspace context, memories, prompts and reusable skill instructions on the user's host.
Model-provider flexibility
Supports a large hosted catalog, ChatGPT/Codex and Claude subscription routes, API billing and local inference.
Cloud and paired execution
Places sessions on the Gateway, owned devices or disposable workers while keeping credentials at the Gateway.
Computer and browser tools
Can view and operate supported desktops or browsers under the configured tool and sandbox policy.
Agent orchestration
Creates background sub-agents, sends work between sessions and tracks durable goals.
Security auditing
Checks trust-model drift, public access, permissions, plugins, skills and live Gateway state and offers narrow safe fixes.
Native companions
Offers signed macOS and Windows applications, with mobile nodes and channel clients extending camera, screen and voice workflows.
Process
How the Openclaw 2.0 workflow works
Step 1
Define one trust boundary
Choose one person or mutually trusting team per Gateway; give separate gateways and operating-system identities to untrusted users or organizations.
Step 2
Start on a dedicated host
Use a separate machine, VM, VPS or operating-system account with full-disk encryption and no personal password-manager profile.
Step 3
Inspect the installer
Prefer signed desktop releases or review downloaded scripts before execution; record the installed release and channel.
Step 4
Choose the data path
Decide whether each workflow can use a hosted provider or requires local inference, and confirm provider retention and training terms.
Step 5
Begin with one narrow workflow
Connect the minimum channel and read-only source needed to prove value before adding email sends, calendars, browser control or shell access.
Step 6
Pair and allowlist senders
Keep direct messages on pairing or explicit allowlists and require mentions in groups unless every member is fully trusted.
Step 7
Isolate multi-user messages
Set per-channel-peer or per-account-channel-peer DM scope so different senders do not share the personal main-session context.
Step 8
Sandbox every shared session
Require per-user sandboxing, workspace-scoped files and denied host execution for guests and external message surfaces.
Step 9
Minimize tools and secrets
Use dedicated service accounts, narrow OAuth scopes, recipient allowlists and no production credentials unless the workflow truly needs them.
Step 10
Treat content as hostile
Assume email, websites, documents and chat messages can contain prompt injection and never let their text redefine security policy.
Step 11
Require consequential approval
Keep a human gate for sending, deleting, purchasing, publishing, deploying, changing permissions, booking travel or making commitments.
Step 12
Run security audits
Execute the normal and deep audit after installation and every change to channels, plugins, reverse proxies, roles, tools or remote access.
Step 13
Expose through a private network
Use a VPN such as Tailscale, authentication and a tested proxy configuration instead of binding the Gateway directly to the public internet.
Step 14
Monitor cost and recovery
Set provider and cloud budgets, back up encrypted state, test credential revocation and practice restoring sessions without exposing secrets.
Cost
Openclaw 2.0 pricing and free plan
OpenClaw 2.0 is free, MIT-licensed software with no required OpenClaw subscription. A user must separately supply model access through a compatible subscription, a metered API key or local inference. Real operating cost therefore depends on model tokens or subscription limits, an always-on computer or VPS, optional disposable cloud workers, storage, external APIs, messaging services and maintenance time. Local models can avoid hosted inference fees but require suitable hardware and electricity. Shared production automation is generally more predictable with dedicated API credentials and explicit budgets than personal subscription reuse. Costs and access paths were checked August 31, 2026.
OpenClaw software
Free
Install the MIT-licensed Gateway, browser UI, apps and core agent framework.
- No required OpenClaw subscription
- macOS, Linux and Windows paths
- Community support and frequent releases
- Operator is responsible for hosting and security
Subscription model access
Provider plan price
Reuse supported ChatGPT/Codex, Claude or other subscription-style access within provider limits.
- Authentication and permitted use vary by provider
- Usage shares the plan's quota windows
- Provider rules can change independently of OpenClaw
- Personal plans are a poor production cost boundary
API model access
Usage-based
Pay the selected provider directly for tokens, tools, media and other API services.
- Best for measurable shared automation
- Set project budgets, limits and alerts
- Background work and tool loops can increase spend quickly
- OpenClaw cost estimates do not replace provider billing
Self-hosted local models
Hardware and electricity
Run supported local providers when data locality matters more than frontier-model convenience.
- No hosted per-token fee
- Requires enough RAM or GPU memory for the chosen model
- Capability and speed depend on hardware and model
- Connected external tools can still transmit data
Remote workers and services
Infrastructure usage
Optional VPS, cloud-worker, storage, phone, search, media and third-party API costs.
- Disposable worker charges depend on the cloud backend
- Idle suspension can reduce compute cost
- Retained snapshots, bandwidth and external APIs can still bill
- Record costs per workflow before scaling
Pricing checked . Check current pricing at the source ↗
Assessment
Openclaw 2.0 strengths and limitations
Where it stands out
- Open-source and self-hosted rather than locked to one assistant or model vendor.
- Version 2.0 materially reduces the setup burden for new users.
- Rebuilt browser interface makes configuration and live observation more approachable.
- Works across macOS, Linux and Windows with signed desktop options.
- Broad model catalog includes subscriptions, APIs and local inference.
- Cross-channel design lets one assistant follow the user through existing messaging habits.
- Persistent memory, skills and automations support genuinely personalized workflows.
- Multi-user session ownership, presence and handoff are unusually capable collaboration features.
- Paired and disposable execution hosts keep provider credentials at the Gateway.
- Detailed security documentation acknowledges prompt injection and trust-boundary limits.
- Security audit tooling catches common exposure, permission and shared-session mistakes.
- A large open ecosystem supports rapid integration and customization.
What to consider
- Powerful tool access makes a successful prompt injection or compromised sender materially dangerous.
- Self-hosting shifts patching, backup, availability, secrets and incident response to the operator.
- The project releases rapidly; upgrades can introduce breaking behavior or migration work.
- One Gateway is one trust domain and is not safe hostile multi-tenant isolation.
- Session ownership and operator roles are guardrails, not a complete security boundary.
- Direct messages share the main session by default unless multi-user isolation is configured.
- A local Gateway can still send sensitive context to hosted model and tool providers.
- Secrets and private state accumulate on disk under the OpenClaw state directory.
- Community plugins and skills add supply-chain and arbitrary-code risk.
- The audit --fix option does not rotate secrets, disable tools or correct every exposure decision.
- Container networking defaults can differ from normal loopback-safe host installs.
- Subscription authentication, API pricing and provider rules can change without an OpenClaw release.
- Long-running background agents can consume significant tokens, compute and external-service quotas.
- Shared agents can expose personal data if personal and company identities are mixed on one runtime.
- Automating email, travel, finance, health or deployment tasks without confirmation can create irreversible harm.
- Frequent integration breadth makes end-to-end testing and observability an ongoing operational requirement.
Compare
Openclaw 2.0 alternatives
The right alternative depends on the specific output, workflow, controls and budget your project requires.
Agents
Hermes Agent
A competing open-source persistent-memory agent with cross-platform messaging for users comparing personal-agent architectures.
Explore Hermes Agent →Agents
ChatGPT Agent
A managed alternative for users who want agentic browser and task execution without operating their own Gateway.
Explore ChatGPT Agent →Agents
Manus Cloud Computer
A hosted always-on environment for deploying agents and applications without maintaining the full local control plane.
Explore Manus Cloud Computer →Business Operations
n8n
Better for deterministic workflow automation where explicit nodes and triggers matter more than a conversational personal assistant.
Explore n8n →Questions
Openclaw 2.0 FAQs
What is OpenClaw 2.0?
It is OpenClaw release v2026.8.1, a major update with simpler onboarding, a rebuilt browser app and first-class multi-user sessions.
Is OpenClaw 2.0 free?
Yes. The software is MIT-licensed and free, but model access, hardware, cloud workers and connected APIs can cost money.
Can I use my ChatGPT or Claude subscription?
OpenClaw supports ChatGPT/Codex subscription OAuth and Claude CLI subscription reuse, subject to each provider's current limits and permitted-use rules.
Can OpenClaw run completely locally?
The Gateway, state and a supported local model can run on your hardware. Any hosted model, search, messaging or external tool still sends relevant data to that provider.
What changed in OpenClaw 2.0?
The headline changes are faster model-first setup, a rebuilt Control UI and multiplayer sessions with creator, owner, participant, presence and handoff support, plus broad improvements across the stack.
Can a team share one OpenClaw?
Yes, when every member is in the same trust boundary. Mutually untrusted people or different organizations should use separate Gateways and hosts.
Are shared-session roles a security boundary?
No. They control collaboration and scope inside one trusted domain. Anyone who can operate an agent can potentially exercise that agent's tool authority.
Which operating systems are supported?
OpenClaw supports macOS, Linux and Windows. Version 2.0 has signed macOS downloads and stable Windows Hub applications.
Is OpenClaw safe to expose on the internet?
Do not expose the Gateway directly. Keep loopback defaults, use strong authentication and a private VPN or carefully configured proxy, then run a deep security audit.
How do I secure multiple DM users?
Use pairing or allowlists and set session.dmScope to per-channel-peer or per-account-channel-peer so users do not share one direct-message context.
What does openclaw security audit --fix do?
It applies narrow remediations such as allowlists and file permissions. It does not rotate tokens, remove plugins, disable tools or redesign network exposure.
Should OpenClaw send emails or make purchases automatically?
Not by default. Require explicit human confirmation for consequential, external or irreversible actions and use dedicated accounts, caps and allowlists.
Bottom line
Our Openclaw 2.0 verdict
OpenClaw 2.0 is a meaningful usability leap for one of the most capable open personal-agent systems: setup no longer needs to front-load every decision, the browser is a real home, and shared sessions turn agent work into something a trusted team can watch and inherit. That polish should not make users casual about authority. OpenClaw can become a control plane for private communications and real actions, and one misconfigured shared Gateway collapses those boundaries. The right rollout is one low-risk workflow on a dedicated host, private network access, a minimal toolset, deep security audits and human approval until logs demonstrate reliable behavior.
Visit Openclaw 2.0 website ↗Similar Agents Tools
View all Agents AI tools →
Keenable
Search API that lets agents query and learn from the live web
Zapier Agents
Zapier Agents: Let you delegate tasks to ai-powered agents that run workflows across apps and services.
Berd
Berd - Block's open-source desktop hub for running custom AI agents
.avif)
Payman
Payman: AI That Pays You for Your Work
AI training for the future of work.
Get access to all our AI courses, hundreds of real-world AI use cases, live expert-led workshops, an exclusive network of AI early adopters, and more.
AI Courses
Get unlimited access to all of our current & upcoming industry-specific AI courses for the duration of your subscription.
Daily Guides
To keep up with the rapid pace of AI, our team publishes AI implementation guides daily. Our library contains 300+ practical use cases to automate real-world work.
Workshops
Join weekly, live, interactive sessions with industry leaders who are at the forefront of AI for hands-on implementation guidance and exclusive insights.
Community
Network with an exclusive community of AI-first professionals who are working smarter with AI. Learn how early adopters are using AI in their work and businesses.