September 5, 2026
OpenClaw changed its defaults so that agents on a shared Gateway can read one another’s sessions and message each other, according to release notes for version 2026.9.2, published on September 5. The change came five days after the OpenClaw Foundation announced the release it calls OpenClaw 2.0.
Takeaway points
- Version 2026.9.2 sets session tools to all-session visibility and turns on agent-to-agent access; operators can narrow it by setting visibility to agent or self.
- The pull request behind the change was reviewed as a security-boundary change before the project merged it on September 3, according to its review record.
- OpenClaw’s documentation says sandboxing is off by default, and that tool execution moves into a sandbox only when an operator enables one.
OpenClaw 2026.9.2 session visibility: what changed
The release notes describe the change in one line: “session tools now default to all-session visibility and ordinary agent-to-agent access is enabled.” Operators who want narrower access can set tools.sessions.visibility to agent or self, and existing tool and sandbox restrictions still apply. The same release turned on Swarm, the project’s sub-agent orchestration, by default “while preserving explicit opt-outs, tool restrictions, and the separate Code Mode opt-in.”
Version 2026.9.2 also added support for OpenAI’s GPT-6 Astra, two days after its launch. Users can select openai/gpt-6-astra with an OpenAI API-key profile or an eligible ChatGPT or Codex account, with text and image input and Responses tool calls. Other changes let active and queued replies survive Gateway restarts, apply more settings without a restart, and keep Git backups intact when text contains embedded NUL characters.
Why OpenClaw made cross-agent session access the default
The change came from pull request 136755, which the project’s maintainers merged on September 3. It changed two settings: session visibility from agent to all, and agent-to-agent access from off to on. The stated reasoning in the pull request was that “one Gateway is one trust boundary,” so agents on the same Gateway should be able to reach each other by default. Operators can still narrow access with the visibility settings, with allowlists, or by switching agent-to-agent access off.
The review attached to the request treated it as a change to a security boundary that needed explicit sign-off from the project’s security owner. It noted that existing configurations without either setting would move from same-agent to Gateway-wide transcript access on upgrade, and that the first draft of the documentation overstated how much isolation disabling agent-to-agent access provides. The review bot, ClawSweeper, blocked one draft for promising full isolation when agent-to-agent access is switched off. The request went through 11 commits and merged with security-owner acceptance recorded from the maintainer who leads the project’s security team. It also added an audit finding that flags the widened default as a warning.
What is OpenClaw 2.0?
OpenClaw 2.0 is the foundation’s name for version 2026.8.1, released on August 31. It was built by 933 contributors, including 569 first-time contributors, from more than 16,000 pull requests, the foundation said, and it holds roughly half of all pull requests ever merged into the project. Before it, OpenClaw had shipped 106 releases in 230 days; this one took nearly seven weeks. Setup now starts from what is already on a computer, including existing ChatGPT or Claude subscriptions, API keys and local models.
The release notes list conversation search, sessions that run on paired devices or cloud workers, masked prompts that let an agent request a credential without the value entering the chat, and a way to approve a recurring automation once for an exact operation, which can later be inspected or revoked and needs fresh approval if the job changes. Two changes are marked breaking: the bundled OpenProse plugin is removed, and model references under codex/ and openai-codex/ migrate to openai/.
Several memory features now start switched on. With Active Memory enabled on a personal install without direct-message isolation, an agent retrieves bounded private conversation context from the same agent by default. Background memory consolidation, which the project calls grounded dreaming, is enabled by default, promotes material into long-term memory with a record the project calls a Dream Diary, and has an explicit control to switch it off. Release 2026.9.2 later added opt-in, listen-only capture of Discord meetings with automatic notes, and 2026.9.3 keeps skills in one persistent collection owned by the agent across workspaces.
OpenClaw sandboxing, secrets and the Node 24 requirement
OpenClaw’s documentation says “Sandboxing is off by default.” The Gateway itself always stays on the host, and only tool execution moves into a sandbox when one is enabled, on Docker, Podman, SSH or OpenShell. The documentation also states that Secret Store values “are not encrypted at rest” and sit in a shared SQLite database protected by file permissions. It recommends an external provider such as 1Password or Vault for stronger isolation. StrideNote has examined what two other local agents send home by default.
The next release, 2026.9.3 on September 8, requires Node 24.16 or newer, or Node 26.1 or newer, and recommends Node 26. The release notes say Node 22 and Node 25 are no longer supported, and that operators should upgrade Node first to prevent SQLite text truncation. The same release rehearses core and plugin updates in an isolated candidate state before activating them, and lets a user publish a revocable, read-only view of a session’s conversation to anyone with its public link. StrideNote’s test machine runs Node 22, so the current release would need a Node upgrade there. StrideNote’s June guide to running OpenClaw with a local model predates both releases.
What the OpenClaw 2026.9.2 release notes do not say
The release notes do not say how many existing deployments change behaviour on upgrade, and they do not flag the session default as a breaking change. Operators who run agents with different owners on one Gateway have to set the visibility option themselves to keep the earlier behaviour.
Sources: OpenClaw 2026.9.2 release notes; pull request 136755; OpenClaw 2026.8.1 release notes; OpenClaw 2026.9.3 release notes; OpenClaw Foundation; sandboxing documentation; secret store documentation.