OpenClaw v2026.4.23 Update: gpt-image-2 can be used directly without an API key, and the sub-agent adds a new "forked context" mode

According to Beating Monitoring, the open-source AI agent framework OpenClaw released version 2026.4.23, with core changes focused on image generation, sub-agent mechanisms, and security enhancements.

In terms of image generation, OpenAI’s gpt-image-2 can now be called directly via Codex OAuth, no longer requiring a separate OPENAI_API_KEY configuration. OpenRouter’s image model has also been integrated, accessible through the image_generate tool. For multi-reference image editing, the method has changed from JSON data URL to multipart upload, fixing previous issues with complex editing failures. Agents can also specify parameters such as image quality, output format, and transparent background as needed.

A new “forked context” mode has been added for sub-agents: when a parent agent spawns a sub-agent, it can choose to have the sub-agent inherit the current dialogue context instead of starting from a blank session each time. The default remains isolation mode, which can be enabled as needed. Additionally, tools for generating images, videos, music, and TTS now support timeout settings at the single-call level, no longer limited by global timeout constraints.

Security enhancements are the largest part of this release. Fixes include: the MCP tool bridge no longer exposes privileged tools like cron to non-owner callers; on Android, external intent injections of prompts are now blocked, only allowing pre-filled drafts; runtime configuration editing of the gateway has been changed from blacklist to whitelist, permitting modifications only to narrow fields like prompt and model; free text in WhatsApp contact cards and location information is no longer directly embedded into messages but rendered using isolated JSON to prevent prompt injection; Teams channels require the Bot Framework token to carry the correct appid, blocking cross-bot token replay.

Regarding the memory system, dreaming (a task for periodically organizing memories automatically) has been separated from heartbeat. Previously, disabling heartbeat would also disable dreaming; now, both operate independently. A new configuration item, memorySearch.local.contextSize, has been added for local embedding context windows, with a default of 4096, making it easier to adjust on low-spec devices.