OpenClaw 2.0: The Open-Source AI Gateway That Lets You Run All Your Models in One Place

On August 30, 2026, the open-source AI agent gateway project OpenClaw released version 2.0 (v2026.8.1). OpenClaw is a self-hosted AI gateway that you install on your own computer or server, then connect ChatGPT subscriptions, Claude API keys, hosted models, and local open-source models into a single system. It routes your requests to the right model for each task, and can access your email, calendar, files, browser, messaging channels, and shell tools. The project calls 2.0 its largest update ever. Here's a comprehensive breakdown of its features and deployment workflow.

12 Core Features

1. Simplified guided onboarding: Auto-detects existing AI access on your computer - ChatGPT subscriptions, Claude API keys, local Ollama instances - verifies connectivity with a real inference request, and lets you start a conversation immediately without manual configuration.

2. Rebuilt browser Control UI: Upgraded from a command-line tool to a full web interface. Manage conversations, monitor agent status, adjust configuration, and observe running tasks directly in your browser.

3. Multi-user sessions: Each session tracks creator, owner, participants, and live presence. Supports view, suggest, and write collaboration modes so team members know who's doing what.

4. Session handoff: Authorized team members can take over running sessions with full context preserved - no copying and pasting history. Essential for team collaboration.

5. Multi-channel messaging: Connects to WhatsApp, Telegram, Signal, Slack, Discord, Google Chat, Microsoft Teams, iMessage, Matrix, and more. Command your agent through the messaging apps you already use.

6. Persistent memory and skills: Custom workspace context, memories, prompts, and reusable skill instructions stored on your local host. The agent remembers your preferences and workflows across sessions.

7. Model-provider flexibility: Supports ChatGPT/Codex subscriptions, Claude CLI subscription reuse, API billing, and local inference through Ollama, LM Studio, llama.cpp, vLLM, and SGLang. Switch between them by task.

8. Cloud and paired execution: Dispatch coding work to remote build machines or disposable cloud workers. The gateway retains full transcripts, credentials, and the merged worktree - execution nodes never see sensitive credentials.

9. Computer and browser tools: Agents can view and operate connected desktops or browsers within configured policies and sandboxes. They can manipulate software, fill forms, and organize files on your behalf.

10. Agent orchestration: Create background sub-agents, send work between sessions, and track durable goals. A master agent can coordinate multiple sub-agents to complete complex tasks.

11. Security auditing: Built-in openclaw security audit --deep command checks for trust-boundary drift, public exposure, excessive permissions, and plugin risks. Run after every configuration change.

12. Native desktop clients: Signed macOS and Windows applications for smoother installation. Mobile nodes and channel clients extend camera, screen, and voice workflows.

14-Step Secure Deployment Workflow

1. Define one trust boundary: One gateway serves one trusted group. Use separate gateways and OS accounts for untrusted users or organizations.

2. Choose a dedicated host: Use a separate machine, VM, VPS, or OS account with full-disk encryption. Don't share with your personal password manager.

3. Inspect the installer: Prefer signed desktop releases, or review downloaded scripts before execution. Record the installed release and channel.

4. Choose the data path: Decide whether each workflow can use a hosted provider or requires local inference. Confirm provider retention and training terms.

5. Start with one narrow workflow: Connect the minimum channel and read-only data source needed to prove value. Add capabilities only when justified.

6. Pair and allowlist senders: Keep direct messages on pairing or explicit allowlists. Require mentions in group chats unless all members are fully trusted.

7. Isolate multi-user messages: Set per-channel or per-account DM scope so different senders don't share the same personal main-session context.

8. Sandbox every shared session: Enable per-user sandboxing, workspace-scoped files, and denied host execution for guests and external message surfaces.

9. Minimize tools and secrets: Use dedicated service accounts, narrow OAuth scopes, and recipient allowlists. Don't provide production credentials unless the workflow truly needs them.

10. Treat content as hostile: Assume email, websites, documents, and chat messages can contain prompt injection. Never let content redefine security policy.

11. Require consequential approval: Keep a human gate for sending, deleting, purchasing, publishing, deploying, changing permissions, booking travel, or making commitments.

12. Run security audits: Execute normal and deep audits after installation and every change to channels, plugins, proxies, roles, tools, or remote access.

13. Expose through a private network: Use a VPN like Tailscale with authentication and a tested proxy configuration instead of binding the gateway to the public internet.

14. Monitor cost and recovery: Set provider and cloud budgets, back up encrypted state, test credential revocation, and practice restoring sessions without exposing secrets.

OpenClaw's security philosophy is straightforward: with great power comes great responsibility. Since it can access email, calendars, files, browsers, messaging, and shell tools, a successful prompt injection can have serious consequences. The project's security documentation is more detailed than most commercial products. Key principles: one gateway per trust boundary, loopback binding by default, isolated sessions, least-privilege tools, audited changes, and human confirmation for consequential actions.

OpenClaw 2.0 is free under the MIT license. Costs depend on your model access choice: ChatGPT/Claude subscription fees, API usage-based billing, or local model hardware and electricity. You also need a host machine or VPS, optional cloud workers, storage, and external API costs. The "free software, pay for models" model may become the standard for AI tools.

It's best suited for technical users who want one self-hosted assistant across messages, email, calendar, files, browser tasks, and scheduled workflows. Also for trusted teams sharing a security boundary who need to observe, steer, assign, and hand off live agent sessions. And for anyone running always-on home or work agents on a dedicated machine.

A few caveats: self-hosting means you own security patches, backups, availability monitoring, and incident response. A misconfigured shared gateway can expose your team's data and tool access. The project releases rapidly; upgrades may introduce breaking changes. Community plugins carry supply-chain and arbitrary-code execution risks. Start with a low-risk workflow, prove value, then expand gradually. Run security audits at every step.

OpenClaw 2.0 reminds me of the early PC era: the most adventurous users built their own machines instead of buying pre-assembled ones. Today's "build your own AI system" crowd is doing the same - connecting all available models and tools themselves. OpenClaw 2.0 lowers that barrier significantly, but it's still built for people who want to get their hands dirty. If you want to see where AI agents are heading, OpenClaw 2.0 is a specimen worth studying closely.