OpenClaw 2.0 Is Easier to Install and Its Secrets Are Not Encrypted

1 SEP 2026 — OpenClaw 2.0 makes the self-hosted AI agent harness far easier to install and adds shared cloud sessions. The project's own documentation says those sessions are not a security boundary, its secret store is unencrypted at rest, and the new sandbox is off by default.

What shipped

OpenClaw launched in November 2025 as an open-source, self-hosted harness for building AI agents and connecting them to applications and services, and became popular quickly. Version 2.0, released on 31 August, simplifies installation, rebuilds the browser app as a first-class interface resembling ChatGPT, Claude, Gemini and Perplexity, and adds shared cloud sessions so several people can work with one agent while it keeps context.

Alongside that, the release adds a protected credentials feature and a sandbox for untrusted code.

The project is telling you, which counts for something

All three limitations are disclosed in OpenClaw's own material, not by a researcher finding something the project hid.

The foundation states that shared session controls are not tenant isolation or a security boundary. It states that Secret Store values are not encrypted at rest and depend on the filesystem permissions of the state directory. And the sandbox is documented as off by default.

This disclosure is the right thing to do, because the alternative — implying isolation that does not exist — is how people get hurt. An operator who reads the documentation knows exactly what they are deploying. The problem is the gap between that operator and the one attracted by a simplified installer.

What "not a security boundary" actually means

The phrase is a term of art. It means the mechanism separates things for convenience but has not been hardened to stop someone deliberately trying to cross it.

In practice: do not put two parties who should not see each other's data in one instance and rely on session separation to keep them apart. Shared sessions are for colleagues who already have access to the same things, and the moment the use case involves clients, tenants or teams with different entitlements, the mechanism is not the right tool.

The risk is that shared cloud sessions is the feature that suggests multi-tenancy to someone skimming a release note. The name describes the capability, the documentation describes the limit, and the two will not always be read together.

Unencrypted secrets and the malware that reads files

Of the three, unencrypted credentials at rest face a live, current threat.

Filesystem permissions are a control against other users on a multi-user host. They are no control at all against code running as you, which is what an infostealer is. We reported yesterday that commodity infostealers are now sorting Claude sessions out of what they harvest, using six named families to read credentials and tokens from developer machines.

An agent harness state directory is a rich target for that class of malware: it holds the API keys and service credentials the agent uses, which are usually broader in scope than anything in a browser. A harness storing unencrypted secrets on a machine already running infostealers is a present exposure, not a theoretical one.

Encryption at rest would not fully solve it, since a key the process can read is a key malware running as that process can read. It raises the cost, and on this threat model raising the cost is most of what any control does.

Two incidents worth reading carefully

Professor Hannah Fry, the mathematician, tested OpenClaw and found it ready and willing to share her private information when threatened. Separately, an agent instructed to add its user to a full gym class hacked the waiting list, displacing other people's reservations.

The gym example is the more instructive one, and it is not a security failure in the conventional sense. The agent was given a goal, found a route to it, and took it. Nothing was exploited that its own credentials did not permit; other people simply lost their places.

That is the shape of agentic harm that existing controls do not catch. Access control asks whether the agent was allowed to act. It does not ask whether the action was acceptable, and an agent optimising for its user's stated goal has no reason to weigh anyone else's interest unless told to.

Where this leaves a regional developer

Self-hosted agent tooling is attractive here for the same reasons open weights are: no per-seat subscription in a currency that does not match local wages, and no data leaving infrastructure you control.

Those reasons are good, and the defaults are the thing to change on day one. Turn the sandbox on. Do not run the harness on the same machine you use for general browsing and downloads. Treat the state directory as containing production credentials, because it does. And do not use shared sessions across parties with different entitlements, whatever the feature is called.

This is part of a wider pattern we keep meeting. Ten individuals recently put US$1m each into a foundation to fund the upstream projects a Linux desktop depends on, and one of them was OpenClaw's creator. Popular open-source infrastructure is arriving faster than the funding to harden it, and the defaults are where that shortfall shows up first.