OpenClaw just shipped the largest release in its history: version 2026.8.1, branded OpenClaw 2.0, landed September 1 after roughly half of every pull request the project has ever merged — about 16,000 of them — piled into a single cycle. That's not a framework update. That's a framework rewrite that happened to keep the same name.
OpenClaw is the self-hosted, open-source agent harness that lets an LLM run as an autonomous agent over WhatsApp, Telegram, Discord, or Signal, built by Austrian developer Peter Steinberger (who joined OpenAI in February 2026). It's one of the general-purpose harnesses in the same lane as Hermes, Codex, and Claude Code — the layer that runs an agent, distinct from the onchain rails (wallets, payment agents, ERC-8004) it might eventually plug into. Before 2.0, the project had shipped 106 releases in 230 days — a near-daily cadence. Then it went quiet for seven weeks. That silence was the tell.
What actually changed
The plan going in was modest: simplify onboarding, rebuild the browser UI. Onboarding now detects an existing Claude or ChatGPT subscription or API key before asking for anything new, and tests the model works before saving config — you land in a conversation, not a settings screen. The control UI was rebuilt around the chat itself, with file browser, git diffs, PR status, and a terminal folded into the same pane instead of a separate dashboard. The team also says it cut JavaScript requests from 140 to 45 and startup time from 1.6 seconds to 575 milliseconds.
That's the release that was supposed to ship. What shipped instead also includes:
- ▸Shared cloud sessions — multiple people working the same agent session mid-task
- ▸Scoped approvals — command permissions tied to specific arguments, not blanket allow/deny
- ▸Docker/Podman sandboxing as an install option
- ▸Role-enforced execution and a team-scoped Secret Store that injects credentials without exposing them to the model
- ▸SQLite for session storage, replacing the old format (back up before you upgrade)
- ▸A split between the Gateway daemon and the agents it routes to
Why two months: the scope-creep story is the actual story
According to the team's own account, the multiplayer and permissions work only entered scope because testing the onboarding fix through shared sessions exposed how much of OpenClaw's architecture assumed a single user. Fixing that meant touching memory, model routing, plugins, messaging, and security at the same time — not sequentially. Hence 933 contributors, 569 of them first-time committers, and a PR count that dwarfs the project's entire prior output. That's either a remarkably disciplined emergency response or a release that got away from its own planning doc — probably both.
Against Hermes, the gap narrows but doesn't close
Hermes still wins on two things OpenClaw 2.0 doesn't touch: procedural memory that auto-converts a successful workflow into a reusable skill, and an architecture that keeps the conversation loop, tool dispatch, and memory in one agent class instead of a routed system. Hermes also ships security defaults that don't assume a single user in the first place — the exact gap OpenClaw just spent two months closing.
And it's only half-closed. OpenClaw's own docs are explicit: one Gateway equals one trust domain, not tenant isolation. Multi-tenant setups need separate Gateways (cells), and the new sandboxing and role controls are opt-in, not default. Steinberger called single-user local setups "relics of the past" after moving his own team to shared cloud sessions — a fair call about where the product is headed, but the hardening that would make that shared-session model safe by default isn't the part that ships turned on.
What to watch
OpenClaw picked up 147,000 GitHub stars in the weeks after this release, per its own reporting, and now counts OpenAI, Microsoft, GitHub, Nvidia, Atlassian, and Tencent as partners through the nonprofit OpenClaw Foundation. That's real enterprise gravity. Whether it's enterprise-*ready* gravity depends on whether the next release turns the sandboxing and scoped permissions from opt-in into default — and whether tenant isolation, not just trust-domain separation, shows up before someone's shared-session pilot finds the gap the hard way.