OpenClaw has released v2026.4.23, with changes focused on image generation, subagent workflows, and security hardening. The open-source AI Agent framework has reached 360,000 GitHub stars, and while maintenance has shifted to the community and a nonprofit foundation, the release pace has stayed active.
GPT-image-2 now works through OAuth instead of a separate API key
The clearest product change is in image generation. OpenAI’s gpt-image-2 can now be called through Codex OAuth 2.1 + PKCE, letting users obtain a short-lived token from a ChatGPT Plus or Pro subscription rather than setting up OPENAI_API_KEY. The onboarding flow is available through a single command: openclaw onboard --auth-choice openai-codex.
OpenRouter image models are now connected through the image_generate tool as well. Multi-reference image editing has been moved from JSON data URLs to multipart uploads, addressing failures seen in more complex editing tasks. OpenClaw also allows agents to set image quality, output format, and transparent background options, while xAI support now includes image generation and speech-to-text.
Subagents inherit chat context and support a three-layer structure
On the agent side, OpenClaw introduced what it calls forked context. Subagents can now inherit conversation history from a parent agent instead of starting from an empty state. They still run in separate sessions, then return results to the original chat channel after execution.
Nested subagent support is now live. With maxSpawnDepth set to 2, users can run a main → orchestrator → workers layout. A single agent can spawn up to 5 subagents, and the global concurrency cap is 8. Access to sensitive tools such as sessions_list and sessions_history is blocked by default for subagents and must be explicitly enabled through a whitelist.
Security fixes cover 13 CVEs, but many exposed instances still lack authentication
The release also builds on a major round of security patches shipped in early April, covering 13 CVEs. Two of them were rated Critical. CVE-2026-35639 allowed privilege escalation through a scope validation bypass, while CVE-2026-35641 involved arbitrary code execution during local plugin installation through a malicious .npmrc file.
Patch availability does not remove deployment risk on its own. Research from Blink found that out of about 135,000 publicly exposed OpenClaw instances worldwide, 63% did not have authentication enabled. That leaves room for unauthenticated remote exploitation in cases involving Critical vulnerabilities. The code may be fixed; whether operators have upgraded and turned on authentication is a separate issue.