Hardening OpenClaw 2.0: Navigating the Enterprise Security Gap

OpenClaw 2.0 dropped over the weekend, and the numbers are staggering: 430,000 lines of code, 16,000 pull requests, 933 contributors — roughly half of every PR ever merged into the project. Peter Steinberger and the OpenClaw Foundation are calling it the most significant update yet.

They're not wrong. The release adds RBAC, sandboxing, approval workflows, secrets handling, and audit logging. It rebuilt the browser interface around conversations instead of configuration panels. It introduced shared cloud sessions and multi-user collaboration. It is, by any reasonable measure, a genuine enterprise security model.

Every single feature is turned off by default.

From Side Project to Infrastructure

OpenClaw started as Clawdbot, Steinberger's November 2025 experiment. It grew faster than his previous project, PSPDFKit, eventually hitting 389,000 GitHub stars and 81,600 forks. The name changed twice — first to Moltbot, then to OpenClaw — before Steinberger joined OpenAI in February 2026 and transferred the project to an independent foundation.

The community that built those numbers was self-hosting and local-first. They ran agents on their own machines, connected via Telegram or Discord, and valued the ability to inspect and control what the agent was doing.

OpenClaw 2.0 moves the center of gravity. Steinberger's team spent the last two months "building OpenClaw with OpenClaw," migrating from individual local harnesses to a shared environment at team.openclaw.ai. He characterized local harnesses as "relics of the past."

While this marks a significant pivot away from local-first workflows, the architectural additions are substantial.

What Actually Shipped

The release notes for v2026.8.2 are extensive. The pieces that matter for infrastructure decisions:

Control UI redesign. Conversations are now the primary interface, with threads in a sidebar and the active conversation occupying the main workspace. Files, approvals, settings, and live agent activity sit around it. The design deliberately mimics ChatGPT, Claude, and Gemini — lowering the barrier for non-technical employees.

Multiplayer sessions. Shared cloud sessions let another employee enter work-in-progress without losing agent context. Multi-user Gateways track who created a conversation and which prompts came from whom. Session ownership, participant attribution, presence indicators, and typing indicators are all present.

Sandboxing. Docker and Podman sandboxes, per-agent and per-session scopes, configurable read-only or read-write workspace access. Role-enforced sandboxing means if the required sandbox cannot be provisioned, execution fails rather than silently falling back to the host.

Approval controls. Tied to specific requests, commands, sessions, and people. Command permissions can be constrained to specific arguments and working directories. Script-backed execution verifies the script still matches what was originally reviewed.

Secret Store. Distinguishes protected secrets from ordinary environment data. For supported requests, credentials can be substituted into a Gateway-hosted HTTPS request without exposing them directly to the model. External references to 1Password and Vault are supported.

Auditing. Expanded around execution identity, approvals, session actions, and outbound messages. Plugin installation triggers capability reviews.

This is a real enterprise security model. But the documentation is explicit about what you need to do to activate it.

The Defaults

From OpenClaw's own documentation and the VentureBeat assessment:

Sandboxing and execution approvals are off by default. The baseline assumes a trusted single operator and permits host execution unless administrators configure stronger restrictions.

Session visibility is permissive by default. Unsandboxed sessions work with other sessions of the same agent by default. The setting tools.sessions.visibility controls this; the default is the widest scope.

Secret Store values are not encrypted at rest. They rely on filesystem protections.

Protected credential substitution doesn't cover all paths. Raw sockets, containers, remote nodes, and provider-native harnesses are excluded.

One Gateway equals one trust domain. Multi-user permissions govern collaboration among trusted users. They are not tenant isolation. For stronger separation between business units or customers, OpenClaw recommends separate "cell" Gateways with separate state, credentials, and workspaces. Fleet tooling for managing those cells remains experimental.

"An enterprise can configure OpenClaw into a substantially hardened environment, but it has to make that decision deliberately." — VentureBeat

Why This Matters (The Incident Record)

This isn't a theoretical concern. OpenClaw has a documented history of running outside its operator's intent:

Summer Yue (Meta Superintelligence Labs director): OpenClaw "ran out of control and deleted her inbox" — publicly posted. No one is safe when the agent acts outside its boundaries, not even top AI executives.

Security firms have warned about tool poisoning and malicious skills on ClawHub that can grab local data and upload it. ClawHub now scans skills for malware, which is an admission that the problem was real.

CVE history is growing as the 430,000-line codebase scales. A codebase that size is functionally unreadable by any individual. Vulnerabilities in dependencies or community skills are not hypothetical.

Upgrades break things. A Slashdot user reported spending "HOURS fixing stuff" after upgrading to 2026.8.2, despite running a separate test instance.

OpenClaw 2.0 is partly a response to these failures. Which makes the decision to leave the new security features off by default more notable, not less.

The NanoClaw Comparison

NanoClaw was built by Gavriel Cohen specifically to address OpenClaw's security posture. The contrast is sharp:

NanoClaw runs each session in its own Docker container with scoped permissions. The container self-destructs when the task completes. If one session is compromised, it cannot affect others. Credentials are injected by a gateway, not placed inside the agent container.

OpenClaw 2.0 can reproduce most of NanoClaw's hardened model. It supports Docker and Podman sandboxes, per-agent scopes, read-only workspace, role-enforced sandboxing, and remote execution nodes. But the starting posture is different. OpenClaw's baseline trusts the operator. NanoClaw's baseline isolates the operator.

The Takeaway: Capability parity is not the same as security parity. OpenClaw provides the tools for a hardened environment; the responsibility for configuration lies with the deployer.

The Compliance Tax

OpenClaw 2.0 does not just add security features. It adds the infrastructure of a workplace: employee interface, live execution monitoring, file management, terminal access, code review integration, model-provider configuration, device pairing, and shared sessions.

That breadth is the bet. NanoClaw gives you a small, auditable agent runtime. OpenClaw gives you a control plane around that runtime. For enterprises, the control plane matters: deployment, authentication, model configuration, auditing, policy enforcement, and an interface employees will actually use.

But the cost reflects that scope. Self-hosting OpenClaw at meaningful scale runs $300–750 per month. NanoClaw self-hosts for $5–50. Enterprise features come with enterprise bills.

Before You Deploy: A Checklist

If you're evaluating OpenClaw 2.0 for a team, these are not optional steps. They are prerequisites.

1. Enable sandboxing. Docker or Podman, per-agent scope, read-only workspace where possible. Do not rely on host execution.
2. Restrict session visibility. Set tools.sessions.visibility to tree or self. The default is too permissive for multi-user environments.
3. Configure approvals for elevated operations. Do not let any user escalate to admin without a second administrator's approval.
4. Audit your Secret Store. Understand what is encrypted, what relies on filesystem permissions, and which execution paths bypass protected credential substitution.
5. Treat each Gateway as one trust domain. Use separate "cells" for real isolation between teams or customers. Do not assume RBAC inside one Gateway equals tenant separation.
6. Review every plugin and skill. Capability reviews exist but are triggered manually. A malicious skill installed before review is still a malicious skill.

OpenClaw 2.0 is a genuine engineering achievement. 16,000 pull requests, 933 contributors, a rebuilt interface, and a security model that can stand up to enterprise scrutiny — if you configure it.

But the gap between "has the features" and "is secure by default" is the same gap that produced the Meta inbox deletion, the growing CVE list, and the user who spent hours recovering from an upgrade. It is a gap that requires deliberate action to close.

For teams evaluating OpenClaw 2.0, the question is not whether it can be secured. It is whether your team will secure it before the first agent goes live.

Because 430,000 lines of code with every safety toggle off is not a feature. It is a risk profile.

Sources

"NanoClaw vs OpenClaw: Choosing Your 2026 AI Agent Framework." DataCamp, 2026. https://www.datacamp.com/blog/nanoclaw-vs-openclaw

"Release openclaw 2026.8.2." OpenClaw GitHub Repository, September 1, 2026. https://github.com/openclaw/openclaw/releases/tag/v2026.8.2

Franzen, Carl. "OpenClaw 2.0 is here, ushering in the era of 'multiplayer' AI coding: What it means for enterprises." VentureBeat, August 31, 2026. https://venturebeat.com/technology/openclaw-2-0-is-here-what-it-means-for-enterprises

"OpenClaw 2.0 Is Here, Ushering In the Era of 'Multiplayer' AI Coding." Slashdot, September 1, 2026. https://developers.slashdot.org/story/26/09/01/1733206/openclaw-20-is-here-ushering-in-the-era-of-multiplayer-ai-coding

Steinberger, Peter. X post on OpenClaw 2.0 and multiplayer coding. https://x.com/steipete/status/2094290652649636173

Johnson, Colin. X post on Solvely's use of OpenClaw multiplayer sessions. https://x.com/colinsolvely/status/2094624645760610589

OpenClaw documentation: "OpenClaw 2.0" blog post. https://openclaw.ai/blog/openclaw-2-accidentally

OpenClaw documentation: Release notes for v2026.8.1. https://docs.openclaw.ai/releases/2026.8.1