OpenClaw 2.0 Adds Shared Agent Sessions, With No Tenant Isolation

OpenClaw 2.0 gives its self-hosted agent platform a guided front door and shared workspaces, then places a clear warning beside them: its collaboration controls are not multi-tenant isolation. The August 30 release is built for a single operator or team that wants to choose its own models and execution environment—not for a product that must safely separate hostile customers.

A long pause ends with a different starting point

OpenClaw released version 2.0 after nearly seven weeks without a shipment, following 106 releases in the preceding 230 days. The update rewrites installation, rebuilds the browser Control UI, moves sessions and transcripts into SQLite, and adds shared cloud sessions.

The setup flow now searches for AI access already present on a machine. It can reuse verified Codex, ChatGPT, or Claude command-line sign-ins; accept an API key; initiate a provider sign-in; or find local Ollama and LM Studio models. Before storing the choice, it tests whether the selected model can answer.

That design reduces the first-run work without locking the agent to one provider. OpenClaw can run with hosted or local models across a laptop, server, paired device, or chosen cloud worker. Fresh OpenAI setups default to GPT-5.6, while its local stack now uses a managed llama-server and raises the default llama.cpp context to 64K.

The browser becomes an operating surface

The rebuilt Control UI centers the conversation but puts active work beside it: files, approvals, and live progress. OpenClaw adds a workspace file editor, a git-backed Changes panel, browser inspection and screenshot annotation, and a full-screen web terminal.

The limits inside those panels

• The file editor cannot create or delete files.
• The Changes panel is read-only, even though it shows pull-request status and CI summaries.
• Create PR hands work to GitHub rather than submitting a pull request inside OpenClaw.

Shared cloud sessions extend that operating surface to another person. An owner or administrator can allow someone to read, suggest changes, work in a draft, or participate directly; the second person can join live work or take it over without losing context. Conversation search, progress cards, dashboards, email triggers, and an experimental authenticated agent-to-agent handoff plugin extend the same idea of longer-running work.

Collaboration stops at one trust boundary

The product documentation is explicit that these shared-session permissions are neither tenant isolation nor a security boundary. That makes the new collaboration features suitable for deployments where participants share a trust relationship, but not a substitute for isolating untrusted customers from one another.

The remaining security posture also belongs to the operator. The Gateway binds to loopback by default, and most chat channels require an unknown direct-message sender to complete pairing. The security audit checks inbound access, tool blast radius, network exposure, browser-control exposure, and plugin allowlists.

Sandboxing remains off by default, and host execution is possible unless it is configured. That is the unresolved next move for teams weighing the release: 2.0 narrows the usability gap for a self-hosted agent, but each deployment still has to decide where its agent may run, which tools it can reach, and how it will contain the result.