OpenClaw 2.0 Ships With Its New Sandbox Off by Default and Credentials Unencrypted at Rest

OpenClaw, the self-hosted AI agent harness, at its 2.0 release

The Register reviewed the largest release in the project's history against the security record that preceded it. The foundation's own documentation states that shared session controls "are not tenant isolation or a security boundary," so separate OpenClaw instances cannot be relied on to stay separate. Credentials held in the local secret store are not encrypted at rest and depend entirely on the filesystem permissions of OpenClaw's state directory. The new sandbox for untrusted code is turned off by default, which leaves contributor-supplied code unconfined unless an operator opts in. The release is documented here because OpenClaw is the harness underneath several incidents already in this list, among them the Taiwan government campaign of July 2026 and the Australian gym booking bypass, and because the shipped defaults determine the blast radius of the next one

Not a vulnerability disclosure. A record of the security posture a widely deployed agent harness chose at a major version boundary: usability first, protections present but opt-in, and a documented refusal to treat instance separation as a security boundary