{"id":114992,"date":"2026-09-01T01:15:40","date_gmt":"2026-09-01T01:15:40","guid":{"rendered":"https:\/\/youzum.net\/openclaw-releases-openclaw-2-0-guided-model-setup-575-ms-control-ui-startup-and-one-trust-boundary-per-gateway\/"},"modified":"2026-09-01T01:15:40","modified_gmt":"2026-09-01T01:15:40","slug":"openclaw-releases-openclaw-2-0-guided-model-setup-575-ms-control-ui-startup-and-one-trust-boundary-per-gateway","status":"publish","type":"post","link":"https:\/\/youzum.net\/fr\/openclaw-releases-openclaw-2-0-guided-model-setup-575-ms-control-ui-startup-and-one-trust-boundary-per-gateway\/","title":{"rendered":"OpenClaw Releases OpenClaw 2.0: Guided Model Setup, 575 ms Control UI Startup, and One Trust Boundary Per Gateway"},"content":{"rendered":"

The OpenClaw team has just released OpenClaw 2.0<\/a>. The team shipped nothing for nearly seven weeks, after 106 releases in the previous 230 days. The update rewrites installation and rebuilds the browser Control UI<\/a>. It also moves sessions and transcripts into SQLite and adds shared cloud sessions<\/a>. <\/p>\n

Is it deployable?<\/strong><\/h2>\n

Yes for single-operator and single-team deployments. No for multi-tenant products.<\/p>\n

Setup starts from credentials you already have<\/strong><\/h2>\n

Guided setup now looks for AI access already on the machine. It can reuse verified Codex, ChatGPT or Claude CLI sign-ins, accept an API key, run a provider sign-in, or find installed Ollama and LM Studio models. It then proves the exact choice can answer before saving that model and credential. Fresh OpenAI setups default to GPT-5.6. On the local side, node-llama-cpp<\/code> was replaced with a managed llama-server<\/code>, Gemma 4 became the RAM-gated llama.cpp default, and the llama.cpp default context was raised to 64K.<\/p>\n

The browser app is now the primary surface<\/strong><\/h2>\n

The rebuilt Control UI<\/a> puts conversations at the center, with files, approvals and live work beside the chat. In a simulated default-chat test with a mocked Gateway and 50 ms HTTP\/1.1 latency, JavaScript requests fell from 140 to 45 and startup fell from roughly 1.6 seconds to 575 ms.<\/p>\n

Docked panels add a workspace file editor, a git-backed Changes panel with pull-request status and CI summaries, a browser panel with element inspection and screenshot annotation, and a full-screen web terminal. The limits are stated plainly: the file editor cannot create or delete files, Changes is read-only, and Create PR hands off to GitHub rather than submitting inside OpenClaw. Approval requests appear inside the conversation that triggered them, with a rolling 30-day history. A \/btw<\/code> command opens a side conversation so a quick question does not pollute the main transcript.<\/p>\n

Storage moved to SQLite, and downgrades are not free<\/strong><\/h2>\n

Sessions and transcripts now live in SQLite. Before rolling back to an older file-backed release, the current CLI must restore archived legacy transcript artifacts, and sessions created after the migration will not appear in older releases. Take a verified backup before upgrading<\/a>.<\/p>\n

Multiplayer, with an explicit ceiling<\/strong><\/h2>\n

Shared cloud sessions<\/a> let a second person join live work or take it over with context intact. Owners and administrators choose whether someone may read, suggest changes, work in a draft, or participate directly. The documentation is direct about the ceiling: these controls are not tenant isolation and not a security boundary. Incognito is off by default, keeps its conversation in process memory, and still sends messages to the model provider.<\/p>\n

Security posture to review before rollout<\/strong><\/h2>\n

The Gateway binds to loopback by default, and most chat channels answer an unknown DM sender with a pairing code. openclaw security audit<\/code> checks inbound access, tool blast radius, network exposure, browser control exposure and plugin allowlists.<\/p>\n

Model choice is treated as the first mitigation for prompt injection. OpenClaw cites a 2026 crowdsourced arena of 272K attacks across 41 agent scenarios, scored only when the agent both executed the harmful action and hid it from the user: 0.5% success against Claude Opus 4.5, 1.0% against Sonnet 4.5, 1.3% against Haiku 4.5, and 8.5% against Gemini 2.5 Pro. The same page warns that adaptive human attackers still exceed 80% success against state-of-the-art defenses, so tool policy, exec approvals and sandboxing remain the hard enforcement layer.<\/p>\n

Interactive explainer<\/strong><\/h2>\n
\n<\/div>\n

\n

Key Takeaways<\/strong><\/h2>\n