OpenClaw 2.0, the latest update to the open-source AI harness, has been released, bringing significant changes to the platform. OpenClaw 2.0 introduces a rebuilt browser interface, shared cloud sessions, and multi-user collaboration, making it more suitable for teams and enterprises.
The new update expands the security model with stronger sandboxing, role-based permissions, approval controls, secrets handling, and auditing. These additions move OpenClaw closer to being infrastructure that an organization could deploy for employees, rather than just a powerful agent for individual developers.
OpenClaw 2.0 seeks to transform what began largely as a personal agent harness into something designed for teams, shared infrastructure, and enterprise workflows. The redesigned Control UI is central to this strategy, bringing conversations, files, approvals, configuration, and live agent activity into a common workspace.
The update also introduces a new UI that could broaden OpenClaw’s appeal beyond developers. The Control UI combines employee interaction, live execution, files, approvals, terminals, code review, model-provider configuration, devices, and shared sessions, making it a more capable platform. Security and isolation are key concerns, with the update introducing more granular controls.
Related: Prompt injection tops security threat lists
OpenClaw’s documentation explicitly states that sandboxing and execution approvals are off by default. Its baseline configuration assumes a trusted single operator and permits host execution unless administrators configure stronger restrictions. This means that enterprises have to deliberately configure OpenClaw to be more secure, using techniques such as AI agent security measures.
One of the key differences between OpenClaw and NanoClaw is their approach to security. NanoClaw emphasizes a smaller codebase, container isolation, and customization through code and skills, while OpenClaw is trying to build a broader operational environment. OpenClaw’s creator, Peter Steinberger, described the long-term ambition as positioning the agent itself as shared infrastructure.
In practice, this means that employees can work together on projects, sharing context and information, without having to manually transfer files or configure agents. This can lead to increased productivity and collaboration, as well as better management of complex projects.
NanoClaw retains a strong proposition for organizations prioritizing a small attack surface, container-first execution, and architectural simplicity. However, OpenClaw is making another bet: that enterprises ultimately need an agent platform to function as both runtime and workplace.
Related: Kaseya launches autonomous IT management platform
For enterprises considering OpenClaw as a centrally operated service, the distinction between OpenClaw and NanoClaw is significant. OpenClaw’s multi-user permissions are designed to govern collaboration among trusted users, but they should not be treated as hard isolation between mutually untrusted tenants. OpenClaw recommends separate Gateway instances, described as “cells,” with separate state, credentials, and workspaces.
According to the report, 933 contributors, including 569 first-time contributors, participated in the release, which includes more than 16,000 pull requests. The release was not shared by Steinberger’s employer, OpenAI, but OpenClaw is now stewarded by the OpenClaw Foundation, an independent 501(c)(3), with OpenAI listed alongside other organizations as partners.
OpenClaw 2.0 is a significant update. It brings the platform closer to being enterprise-ready. While it doesn’t eliminate security risks, it provides many of the primitives needed to build an enterprise-grade environment. As enterprises consider deploying OpenClaw, they must carefully evaluate their security needs and configure the platform accordingly.
