OpenClaw 2.0: 575 ms UI Startup, SQLite Storage, One Trust Boundary
In this article
OpenClaw 2.0 (tagged v2026.8.1) arrived after a 49-day release freeze — a deliberate pause following 106 releases across the previous 230 days. The update rewrites the installation flow, rebuilds the browser Control UI from scratch, migrates session and transcript storage to SQLite, and introduces shared cloud sessions with an explicitly bounded collaboration model. The architecture decisions around UI performance and the single-trust-boundary constraint are the details that determine whether this release fits a given deployment.
Guided Setup and Local Model Changes
The new onboarding logic scans for AI access already present on the host machine before requesting new credentials. It can reuse verified Codex, ChatGPT, or Claude CLI sign-ins, accept a raw API key, run a provider sign-in flow, or enumerate installed Ollama and LM Studio models. The selected model must pass a live response probe before setup persists the credential — a guard against misconfigured silent failures in agent pipelines.
On the local inference side, node-llama-cpp was replaced with a managed llama-server, Gemma 4 became the RAM-gated default for llama.cpp, and the default context window was raised to 64K tokens. Fresh OpenAI setups default to GPT-5.6.
Control UI: What the 575 ms Figure Actually Measures
The rebuilt Control UI consolidates conversations, file access, approvals, and live work output into a single browser surface. The performance headline — startup dropping from roughly 1.6 seconds to 575 ms — comes from a specific test configuration: a simulated default-chat scenario against a mocked Gateway with 50 ms HTTP/1.1 latency injected. Under those conditions, JavaScript requests dropped from 140 to 45. Hidden panels no longer fetch data they are not rendering.
The workspace adds a docked file editor (read and edit only — file creation and deletion are absent), a git-backed Changes panel displaying pull-request status and CI summaries in read-only mode, a browser panel supporting element inspection and screenshot annotation, and a full-screen web terminal. Pull request submission hands off to GitHub rather than completing inside OpenClaw itself. Approval requests surface inside the conversation that triggered them, with a 30-day rolling history, and a /btw command opens a lateral side conversation to keep quick clarifications out of the primary transcript.
The Single Trust Boundary: What It Permits and What It Doesn't
OpenClaw 2.0's multiplayer feature lets a second operator join a live session or take it over with full context carried forward. Session roles — read, suggest, draft, or direct participation — are assigned by owners and administrators. The documentation is explicit that these controls are collaboration guardrails, not tenant isolation and not a security boundary.
| Deployment scenario | Supported | Reason |
|---|---|---|
| Single operator, own machine | Yes | Default posture; Gateway binds to loopback, unknown DM senders receive a pairing code |
| Mutually trusting team, one gateway | Yes | Named operator roles bound actions, but docs classify these as collaboration controls only |
| Multiple customer orgs sharing one gateway | No | Docs recommend isolated gateway cells per tenant; cross-tenant sharing is explicitly out of scope |
| Public tool-enabled agent (adversarial users) | No | All users sharing a gateway share that agent's delegated tool authority; separate OS users or hosts required |
Security Posture and Prompt Injection Data
The Gateway defaults to loopback binding. The openclaw security audit command covers inbound access, tool blast radius, network exposure, browser control exposure, and plugin allowlists. Model selection is positioned as the first mitigation layer against prompt injection.
OpenClaw cites a 2026 crowdsourced arena of 272,000 attacks across 41 agent scenarios, scored only when an agent both executed the harmful action and concealed it from the user. Results: Claude Opus 4.5 at 0.5% attacker success rate, Sonnet 4.5 at 1.0%, Haiku 4.5 at 1.3%, and Gemini 2.5 Pro at 8.5%. The same documentation notes that adaptive human attackers still exceed 80% success against state-of-the-art defenses — which is why the docs position tool policy, execution approvals, and sandboxing as the hard enforcement layer, not model choice alone. For prior coverage of OpenClaw's trust surface, see NanoClaw and OpenClaw security.
The SQLite migration carries an operational caveat: sessions created after migration will not appear in older releases, and the CLI must restore archived legacy transcript artifacts before any downgrade. The release notes recommend a verified backup before upgrading.
OpenClaw 2.0 reflects a project choosing deliberate architectural consolidation over release velocity — tighter UI performance contracts, explicit deployment ceilings, and documented security scope. The 575 ms startup target and the one-trust-boundary-per-gateway rule together define what the tool will not do, which for production engineering teams is often more useful than a feature list.