OpenClaw, the open-source AI agent framework, just shipped version 2026.4.23 with a trio of changes: easier image generation, smarter sub-agents, and a laundry list of security fixes.
This update follows a previous release that patched a command authorization vulnerability and made gpt-image-2 the default. Now, OpenAI's gpt-image-2 model is accessible through Codex OAuth — no separate OPENAI_API_KEY needed. OpenRouter's image models are also supported via the same image_generate tool. Multi-reference image editing has been upgraded from JSON data URLs to multipart uploads, fixing previously flaky complex edits. Agents can now specify quality, output format, transparency, and more per request.
Sub-agents get a new "forked context" mode. When spawning a child agent, the parent can choose to pass along the current conversation context instead of starting from scratch. Default remains isolated; you opt in. Plus, image, video, music, and TTS generation tools now support per-call timeout settings, no longer bound by the global timeout.
Security is the biggest chunk of this release. The MCP tool bridge no longer exposes privileged tools like cron to non-owner callers. On Android, external intents can't auto-send injected prompts — they only prefill drafts. Gateway runtime config editing switched from a blacklist to a whitelist, limiting changes to prompt, model, and a few other fields. WhatsApp contact cards and location info no longer concatenate free text into message bodies; instead, they use isolated JSON rendering to block prompt injection. Teams channels now require Bot Framework tokens to carry the correct app ID, preventing cross-bot token replay.
Memory system tweaks: the dreaming task (periodic memory consolidation) is now decoupled from the heartbeat — disabling one no longer disables the other. Local embedding context window size is now configurable via memorySearch.local.contextSize, defaulting to 4096, handy for lower-end devices.