OpenClaw v2026.4.23 Update: gpt-image-2 Now Usable Without API Key, New 'Forked Context' Mode for Sub-Agents

According to monitoring by Dongcha Beating, the open-source AI agent framework OpenClaw has released version v2026.4.23, with core changes focused on image generation, sub-agent mechanisms, and security enhancements. In terms of image generation, OpenAI’s gpt-image-2 can now be called directly via Codex OAuth, eliminating the need for a separate OPENAI_API_KEY configuration. OpenRouter’s image model has also been integrated, allowing usage through the image_generate tool. The multi-reference image editing has shifted from JSON data URL to multipart upload, resolving previous issues with complex editing failures. Agents can now specify parameters such as image quality, output format, and background transparency as needed. The sub-agent has introduced a ‘forked context’ mode: when a parent agent derives a sub-agent, it can choose to have the sub-agent inherit the current conversation context instead of starting from a blank session each time. The default remains isolation mode, which can be activated as needed. Additionally, image, video, music, and TTS generation tools now support timeout settings at the individual call level, no longer subject to global timeout restrictions. Security enhancements are the most extensive in this version. Fixes include: the MCP tool bridge no longer exposes privileged tools like cron to non-owner callers; on Android, external intents are prohibited from automatically sending injected prompts, allowing only pre-filled drafts; gateway runtime configuration editing has shifted from a blacklist to a whitelist, permitting modifications only to narrow fields like prompts and models; free text in WhatsApp contact cards and location information is no longer directly concatenated into the message body, but rendered using isolated JSON to prevent prompt injection; Teams channels require the Bot Framework token to carry the correct appid, blocking cross-bot token replay. Regarding the memory system, dreaming (a task for periodically auto-organizing memories) has been separated from the heartbeat; previously, disabling the heartbeat would also disable dreaming, but now they do not affect each other. The local embedding context window has added a memorySearch.local.contextSize configuration option, defaulting to 4096, facilitating adjustments on low-spec devices.