After shipping 106 releases in 230 days, the OpenClaw team went dark for nearly seven weeks. Now we know what they were building. OpenClaw 2.0 is out, and it’s not a minor bump—the installation flow, the browser Control UI, and the storage layer have all been rebuilt from scratch.
Setup now detects AI access already sitting on your machine. If you’re signed into Codex, ChatGPT, or Claude CLI, OpenClaw reuses those verified credentials. It can also grab an API key, run a provider sign-in, or find local Ollama and LM Studio models. The kicker: before saving anything, it proves the exact model you picked can actually answer a prompt. Fresh OpenAI setups default to GPT-5.6. On the local side, node-llama-cpp is gone, replaced by a managed llama-server. Gemma 4 is now the RAM-gated default for llama.cpp, and the default context window jumped to 64K.
The rebuilt Control UI shows real numbers. In a simulated default-chat test with a mocked Gateway and 50 ms latency, JavaScript requests dropped from 140 to 45—a 68% cut—and startup fell from roughly 1.6 seconds to 575 ms. That’s the kind of improvement you feel. The UI now centers conversations, with files, approvals, and live work docked beside the chat. A new /btw command opens a side conversation so quick questions don’t pollute your main transcript.
Storage has moved to SQLite, which brings shared cloud sessions and real multiplayer. A second person can join live work or take over with context intact, and owners set permission levels: read, suggest, draft, or participate directly. But the docs are blunt about the ceiling—these controls are not tenant isolation and not a security boundary. Incognito mode stays off by default, keeps conversations in process memory, and still sends your messages to the model provider. Before rolling back to an older file-backed release, you’ll need to restore archived legacy transcripts, and sessions created after migration won’t appear in older versions. Take a verified backup first.
The security section treats model choice as the first mitigation for prompt injection, citing a 2026 crowdsourced arena of 272K attacks across 41 agent scenarios. Claude Opus 4.5 scored a 0.5% success rate against attacks that executed harmful actions and hid them from users, while Gemini 2.5 Pro hit 8.5%. The same page warns adaptive human attackers still clear 80% success against state-of-the-art defenses, which means tool policy, exec approvals, and sandboxing remain the actual enforcement layer. That’s the honest framing more AI tools should adopt.
