OpenClaw 2.0 Security: What v2026.8.1 Fixes for Crypto Users

OpenClaw 2.0 shipped on August 31, 2026 as version 2026.8.1, closing a roughly two-month stabilization cycle that pulled in 933 contributors, 569 of them first-time, and more than 16,000 merged pull requests. Security is the headline. Session permission modes, masked credential prompts, plugin trust review, and model allowlists all landed in the same release.

For anyone holding crypto on the machine where OpenClaw runs, though, the useful question is narrower: of the seven security risks we documented in our OpenClaw security guide, how many does 2.0 actually close?

The short answer: two are substantially fixed, two are partly mitigated, and three are untouched. The three untouched ones are the ones where money actually leaves your wallet.

What actually shipped in OpenClaw 2.0

Five changes in this release have direct security consequences. The rest of the changelog — conversation search, distributed cloud sessions, durable progress cards, Telegram Mini App dashboards, Discord voice — is product surface, not defense.

Change in 2.0	What it actually does
Session permission modes	Explicit per-session permission boundaries with filesystem access anchored to the workspace, so an agent cannot reach files outside its designated directory
Private credential requests	An agent requests a secret through a masked prompt; the value never enters chat history or model context
Credential store hardening	Shared write-only credential store with network egress bound to declared hosts, plus optional 1Password broker integration
Plugin trust review	Capabilities, source, version, and artifacts are surfaced before you install, rather than after
Model allowlists and config auditing	Operators restrict which models an agent may call, per-agent or provider-wide; config changes are recorded with writer labels and sensitive values redacted

On performance, Gateway startup dropped from roughly 1.6 seconds to about 575 milliseconds, and default agent concurrency now scales with CPU count — typically 8 to 16 simultaneous runs. SQLite storage picked up snapshot verification, corruption quarantine, and write-ahead-log split-brain protection. Fast concurrent agents are a convenience feature, but they also mean more autonomous actions per minute against whatever permissions you granted.

Scoring 2.0 against the seven risks

Here is the same seven-risk framework, re-scored against what 2.0 ships.

Risk	Status after 2.0
1. Malicious skills on ClawHub	Partly mitigated
2. Supply chain attacks on the installer	Partly mitigated
3. API keys and credentials in plain sight	Substantially fixed
4. Permission over-granting	Substantially fixed
5. The agent placing trades for you	Unchanged
6. Social engineering	Unchanged
7. Smart contract interaction risk	Unchanged

Substantially fixed: credential exposure

This was the most mechanically dangerous item on the original list, and 2.0 addresses it at the right layer. Previously, a secret handed to an agent could end up in chat history, in model context, and from there into a provider’s logs or a subsequent prompt. Private credential requests break that chain: the prompt is masked and the value is excluded from both chat and model context.

The egress binding matters just as much. Restricting protected-secret substitution to declared hosts means a compromised skill cannot quietly ship your API key to an attacker-controlled endpoint, because the destination was never on the list. Combined with the write-only credential store, this closes the most common path from “agent has your key” to “attacker has your key.”

What it does not do is protect a key you paste directly into a chat message out of habit. The mechanism only helps if you use it.

Substantially fixed: permission over-granting

The original “allow all” trap was that permissions were coarse and sticky: grant broad access once for convenience, keep it forever. In 2.0, permission modes resolve to an explicit pair of settings: an allowlist strictness level and a prompt-on-miss behavior. The auto mode adds a native auto-reviewer that adjudicates misses itself and only escalates to a human when it cannot safely approve.

Workspace-anchored filesystem access is the more important half. An agent confined to its workspace directory cannot read wallet files, shell histories, or key material sitting elsewhere on the machine, which is precisely how several documented agent-related credential thefts worked. One-time approval grants for recurring automations also remove the standing incentive to widen permissions permanently just to stop the prompts.

Partly mitigated: malicious skills and supply chain

Plugin trust review is a real improvement. Seeing capabilities, source, version, and artifacts before installation converts a blind install into an informed one, and config auditing with writer labels means a silent change is now a recorded change.

But the marketplace economics are unchanged. The SKILL.md format is explicitly unchanged in 2.0 so that existing marketplace skills stay compatible without modification, which is good for authors and neutral for attackers. Nothing in this release re-screens what is already published, and nothing removes a malicious skill you installed before upgrading. If a hostile skill was on your machine on August 30, it is still there on September 1.

The installer supply chain is likewise outside the scope of a permission model. Trust review tells you what a plugin declares. It does not tell you whether the artifact you downloaded is the artifact the author published.

Unchanged: the three that involve money

Risks 5, 6, and 7 — the agent trading on your behalf, social engineering, and smart contract interaction — are all substantially unaddressed, and the reason is structural rather than an oversight.

OpenClaw 2.0 secures the boundary around the machine: which files an agent may read, which secrets it may see, which hosts it may reach, which models it may call. Every one of those is a local-perimeter control. None of them can evaluate an on-chain transaction. There is no transaction simulation, no per-day spend ceiling, no protocol allowlist, no malicious-contract scanner, because none of that belongs in an agent runtime.

Structured questions delivered as native cards, replacing free-text prompts, marginally raise the bar for social engineering by making a coerced instruction look less like a normal conversational turn. That is a nudge, not a control.

It is worth being specific about why the social engineering risk survives a permission overhaul. The attacks that matter in this ecosystem do not ask the agent to exceed its permissions. They ask it to use them. A prompt injected through a web page the agent was legitimately asked to read, a support message that arrives through one of the expanded channels, a repository the agent was told to summarize: in each case the instruction arrives inside content the agent has every right to process, and the resulting action is inside the permission grant. Workspace anchoring does not help, because nothing is trying to leave the workspace. Model allowlists do not help, because the model is behaving as designed.

The expanded channel surface in 2.0 cuts slightly against the security work here. First-class Slack with Enterprise Grid support, Telegram Mini App dashboards, Discord voice participation and presence-based wake triggers all add legitimate places from which an agent can receive instructions. Each is a product win and each is an additional path for a message that was not written by you.

So the position after upgrading is this: an agent that has been correctly confined to its workspace, cannot see your API keys in cleartext, and can only call approved models, and that will still sign a wallet-draining approval if it is convinced to, with no spending limit standing in the way.

Why the remaining three are the expensive ones

The gap is wide enough that the wallet layer has started filling it directly. On August 6, 2026 — three weeks before 2.0 — MetaMask launched Agent Wallet, a self-custodial wallet built specifically for AI agents, and its feature list reads almost exactly like the three risks OpenClaw does not cover: daily spend limits, allowlisted protocols, transaction simulation before signing, and threat scanning that auto-rejects malicious transfers.

Notably, OpenClaw is one of the six agent frameworks MetaMask names as supported, alongside Claude Code, Codex, Hermes, OpenCode, and Cursor. The two products are not competing. They are securing different layers of the same stack. This is the same division of responsibility we mapped in our comparison of Hermes Agent and OpenClaw for crypto users: the runtime governs what the agent can touch, and something else has to govern what the agent can spend.

Treating a runtime permission upgrade as wallet security is the mistake to avoid here. They are not substitutes.

The concurrency change deserves its own note

One item in the release is filed under performance but behaves like a security change: default agent concurrency now scales with CPU count, landing at roughly 8 to 16 simultaneous runs on typical hardware, and Gateway startup dropped to about 575 milliseconds.

Permissions are per-session. Throughput is not. If your permission grants were calibrated during 1.x, when fewer agents ran at once and each one started slower, the same grants now authorize several times more actions per minute. Nothing was loosened; the ceiling just moved because the thing underneath it got faster.

This matters most for any automation touching an exchange API or a hot wallet. A rate limit that was effectively enforced by how slowly the agent worked is no longer enforced by anything. If you relied on that implicitly, and most people did without ever framing it as a control, the upgrade removes it silently.

The SQLite hardening in this release, covering snapshot verification, corruption quarantine, and write-ahead-log split-brain protection, is genuinely welcome alongside that concurrency increase. More simultaneous writers against the same store is exactly the condition under which the old storage layer would have been most likely to corrupt state.

What to do before you upgrade

The upgrade path is back up, update, then run openclaw doctor --fix, which handles all three breaking changes automatically. Those are the retirement of the OpenProse plugin with its config cleaned up, the migration of codex/* and openai-codex/* model references to openai/*, and the deprecation of plugin SDK subpath imports, which took effect September 1, 2026 and only affects plugin authors.

Four things worth doing in the same session, given what 2.0 does and does not change:

• Audit installed skills before upgrading, not after. Trust review only applies at install time. It will not retroactively flag something already on your system.
• Re-issue any credential the agent has already seen. Masked prompts protect secrets going forward. A key that sat in chat history under 1.x should be treated as exposed and rotated.
• Set permission modes deliberately rather than accepting defaults. The auto-reviewer in auto mode approves misses on its own judgment; if the agent has access to anything that moves funds, ask is the safer setting.
• Put the spend limit somewhere else. Because 2.0 does not provide one, the ceiling has to live at the wallet: either an agent wallet with policy enforcement or a dedicated hot wallet holding only what you can afford to lose.

If you are using OpenClaw for market work specifically, our complete guide to OpenClaw AI trading skills covers the setup side, and the two-person rule for any fund transfer still applies after 2.0 exactly as it did before.

The layer no agent runtime can secure

The pattern running through this release is worth stating plainly: 2.0 is an excellent local-perimeter upgrade, and local perimeters do not protect money in motion. The moment value moves on-chain, custody design decides what an attacker can actually take.

That principle scales past individual traders. For a business accepting crypto, the equivalent question is who holds the funds between a customer paying and the money reaching you. If a custodial processor sits in that gap, then their breach, their outage, and their compliance freeze are all your problem, and no amount of hardening on your own machine changes it.

Aurpay is built the other way around: a non-custodial payment gateway where customer payments settle directly into the merchant’s own wallet at a flat 0.8% per transaction, with no intermediary account in the path. The trade-off is the same one OpenClaw 2.0 makes at the filesystem: reduce what a compromise can reach, rather than trying to make compromise impossible. If you are weighing that decision for a business, our breakdown of custodial versus non-custodial payment gateways works through what each model exposes.