The open-source AI agent platform OpenClaw has just rolled out version 2026.4.21. This release is primarily about integrating OpenAI's latest image generation model and plugging a command authorization vulnerability.
The platform's built-in image generation channel and automated tests now default to gpt-image-2. Documentation and metadata have also been updated to include new prompts for 2K and 4K image sizes. If the primary model fails during generation, the gateway will now log the error before triggering an automatic fallback. This change prevents the previous silent switch that made it difficult to diagnose issues with the OpenAI API.
On the security front, the update patches a command privilege escalation vulnerability (tracked as #69774). Previously, if the owner-exclusive command control feature (enforceOwnerForCommands) was enabled without a configured whitelist (ownerAllowFrom), regular users could exploit a broad fallback policy to bypass restrictions. The system now enforces verification of owner identity or operator.admin permissions.
Other routine fixes include a tweak to the browser extension, which now immediately blocks instead of waiting for a timeout when it can't find an accessibility node. The platform has also resolved an issue where outgoing Slack messages wouldn't stay in their original discussion threads.