OpenClaw 2.0 Enhances AI Agent Security with Major Upgrades
OpenClaw 2.0, the latest release of the open-source AI agent platform, introduces significant security enhancements for AI agents, plugins, and credential management.
OpenClaw has unveiled version 2026.8.1, dubbed OpenClaw 2.0, marking its most substantial update to date. Developed by a community of 933 contributors, this release represents a significant shift in the project's trajectory, pausing its rapid release cycle to build a more robust and secure foundation. The development focused on enhancing the security posture for AI agents that interact with various tools, files, browser sessions, and enterprise services.
A core security improvement in OpenClaw 2.0 is the introduction of private credential requests. This feature allows AI agents to request sensitive information through masked prompts, ensuring that credentials are not exposed in chat histories or model contexts. To further mitigate risks, an opt-in proxy is available to restrict protected secret substitution to authorized destinations, preventing unintended credential leakage. For collaborative environments, a new shared credential store enables administrators to manage team-scoped secrets and environment values via command-line interfaces and settings, with secrets remaining write-only and outbound connections bound to declared hosts.
Plugin security has also seen a major overhaul. Before installation or enablement, OpenClaw 2.0 now details the capabilities, source, version, and artifact information of external plugins. While installations from arbitrary executable sources will require a --force flag, trusted sources like ClawHub, official catalogs, and tracked updates can bypass provenance warnings, though capability consent is still mandatory. The platform also integrates security audit information from ClawHub directly into the plugin installation process.
For agent execution, OpenClaw 2.0 introduces explicit session permission modes and workspace restrictions. Filesystem access is now anchored to the recorded workspace or worktree, limiting an agent's ability to access files outside its designated scope. Team operators can define which agents, sessions, and administrative scopes are accessible to verified users. However, the developers caution that these are collaboration-focused features, not intended for hostile multi-tenant isolation.
The update also refines the approval process for recurring automations. Users can now approve specific operations once, with the ability to inspect or revoke permissions later. New approvals are required if the automation's operation changes, preventing workflows from silently expanding their authority over time. This granular control is crucial for maintaining security as automations evolve.
Further defensive measures include model allowlists, a configuration-change history with redaction of sensitive values, database recovery protections, sanitized debugging handoffs, safer startup migrations, and fixes to prevent private prompt context from appearing in replies. The browser control UI has been rebuilt as a primary workspace, and the release adds shared cloud sessions, agent dashboards, and expanded support for local and external model providers.
The significant scale of OpenClaw 2.0's security enhancements underscores the growing importance of securing AI agents, especially those handling production credentials, plugins, or cloud integrations. Organizations are advised to conduct thorough security reviews and implement staged deployments to fully leverage these new protections.