OpenClaw

OpenClaw 2.0, shipped as v2026.8.1, materially expands the project from a self-controlled personal-agent runtime into a persistent workspace that can place sessions on paired devices or cloud workers while the Gateway retains durable conversation state.¹²³ The release also broadens the browser workspace with conversation search, progress surfaces and richer session management, and it adds more explicit permissions around recurring automations and remote execution.¹

The core proposition remains unusually open and model-neutral. OpenClaw connects models, messaging channels, tools, skills and device nodes rather than locking the user to one foundation-model provider. That makes it highly extensible, but the quality of an underlying Claude, GPT or Gemini model cannot be transferred directly to the complete OpenClaw workflow: runtime quality also depends on configuration, tools, skills, permissions, provider routing and the environment in which actions execute.⁴

The OpenClaw software remains free and open source. Operating cost comes from the model providers and external services chosen by the user, including model/API calls, search, speech, media processing and third-party services where applicable.⁵ The 2.0 release does not turn OpenClaw into a bundled subscription product; users still need to account for provider-specific authentication, quotas and usage charges.

Installation and operation are more approachable than many agent frameworks, but they are still technical. OpenClaw spans macOS, Linux and Windows, with iOS and Android companion surfaces and a browser Control UI; remote and multi-machine workflows additionally require a correctly secured Gateway and paired execution environment.⁶²

OpenClaw 2.0 improves several controls that matter for a high-privilege agent. Protected credential values can be collected without placing the value into model context; SecretRef-based handling can constrain how secrets are resolved and where they are substituted at egress.⁷⁸ The Control UI is gated by Gateway authentication and device pairing, while short-lived scoped tickets are used for protected media access.⁹

Those improvements do not make the system automatically isolated. Current security documentation treats authenticated Gateway callers as trusted operators, describes one Gateway as one trust domain, and warns that collaboration/session roles are not a tenant-isolation boundary.¹⁰ Native plugins run in-process as trusted code. Execution approvals reduce accidental command execution but are not a per-user authorization boundary, and remote system execution remains powerful within the permissions of the host or sandbox.¹¹ Independent post-2.0 analysis reaches the same practical conclusion: shared sessions and roles should not be treated as a security boundary, and optional isolation must be deliberately configured.¹²

The broader evidence base still supports caution. Earlier high-authority reporting documented prompt-injection, plugin, credential and enterprise-governance risks around OpenClaw's deep system access; those reports predate 2.0 and are useful as risk context rather than proof of defects in the current release.¹³¹⁴ Current exact-domain Trustpilot feedback is only 2.9/5 from two reviews, far too small and self-selected to support a numeric product rating; it is retained only as qualitative setup/security sentiment.¹⁵

OpenClaw is strongest for developers, self-hosters and technical teams that want control over the runtime, model choice, integrations and deployment topology. The 2.0 session architecture is particularly relevant when persistent work must move between a Gateway, paired devices and remote workers without abandoning the durable session state.²

It is a weaker fit for people seeking a zero-maintenance consumer assistant or for organizations that need hard multi-tenant isolation without additional architecture. Teams must be prepared to manage credentials, pairing, plugins, execution permissions, provider costs and the security boundary of each connected host.¹⁰⁷