OpenClaw Update: Image Generation Gains + Security Fixes
🚀 OpenClaw 2026.4.21 Update: Image Generation Improvements + Multiple Security Fixes
OpenClaw shipped April 22 with its 2026.4.21 release, and on April 21 it rolled out 2026.4.20 — two releases back to back.
📅 The 2026.4.21 Release (April 22)
Key improvements
| Improvement | Details |
|---|---|
| OpenAI/images | now defaults to gpt-image-2, with 2K/4K size hints supported |
| Plugins/doctor | Fixes runtime dependency recovery for bundled installs |
| Image generation | Failed provider/model attempts now log at warn level |
Important fixes
- Auth/commands: owner authentication is now required — non-owners can no longer run owner-only commands (PR #69774)
- Slack: thread aliases are preserved, so runtime sends stay in the intended thread (PR #62947)
- Browser: invalid ax accessibility refs are rejected instead of waiting for a timeout (PR #69924)
- npm/install: mirrors the node-domexception alias to resolve a deprecated dependency chain
📅 The 2026.4.20 Release (April 21)
Key improvements
| Improvement | Details |
|---|---|
| Onboard/wizard | Redesigned security warning styling, a loading spinner, and an API key placeholder (PR #69553) |
| Agents/prompts | Beefed-up default system prompts and the GPT-5 overlay |
| Models/costs | Supports tiered model pricing, including Kimi K2.6/K2.5 cost estimates (PR #67605) |
| Sessions/Maintenance | Enforces built-in entry caps to prevent OOM (PR #69404) |
| Moonshot/Kimi | now defaults to kimi-k2.6, with thinking.keep = "all" support (PR #69477, #68816) |
| Mattermost | Streams thinking, tool activity, and partial replies (PR #47838) |
| BlueBubbles/groups | Adds group systemPrompt support, injecting group-specific instructions (PR #69198) |
Other improvements
- Cron: runtime execution state now lives in a separate jobs-state.json (PR #63105)
- Agents/compaction: sends notifications when compaction starts and finishes (PR #67830)
- Plugins/tests: reuses the plugin loader alias to cut test overhead (PR #69316)
- Terminal/logging: improved sanitizeForLog() (PR #67205)
- QA/CI: the QA suite now fails the build by default (PR #69122)
Fixes
- Exec/YOLO: fixes the Python/Node script preflight in security=full + ask=off mode
💡 Feature Highlights Explained
1. gpt-image-2 Becomes the OpenAI Default
OpenClaw has switched its default image generation provider to gpt-image-2:
- Higher resolution: 2K and 4K size hints are supported
- Better quality: it's OpenAI's latest image generation model
- Docs updated: tool metadata and documentation have been refreshed
2. Moonshot Kimi K2.6 as the New Default
OpenClaw now defaults Moonshot/Kimi to kimi-k2.6:
- Stronger performance: K2.6 outperforms K2.5
- thinking.keep: supports thinking.keep = "all"
- Compatibility: K2.5 still works if you need it
3. Session OOM Protection
OpenClaw now enforces session entry caps:
- OOM prevention: cron/executor session backlogs can no longer blow up memory
- Cleanup on load: oversized stores get trimmed at load time
- Enforced by default: built-in caps and age-based cleanup are on out of the box
4. Hardened Auth
OpenClaw has tightened security around owner commands:
- Owner identity required: an owner-candidate match or operator.admin is required
- Wildcard fallback rejected: an empty owner-candidate no longer counts as sufficient
- enforceOwnerForCommands: stricter command permission enforcement
📊 The Two Releases at a Glance
| Release | Release date | Highlights |
|---|---|---|
| 2026.4.21 | April 22 | Image generation, auth security, Slack/Browser fixes |
| 2026.4.20 | April 21 | Wizard styling, Kimi K2.6, Mattermost streaming, OOM protection |
Two releases in two days — the OpenClaw team keeps shipping improvements.
🙏 Contributor Shoutouts
Thanks to the following contributors for this release:
- @drobison00 – Auth/commands fix
- @bek91 – Slack thread aliases
- @Patrick-Erichsen – Wizard styling, Browser ax
- @sliverp – Models/costs tiered pricing
- @bobrenze-bot – Sessions OOM protection
- @Feelw00 – Cron jobs-state
- @feniix – Agents/compaction
- @scoootscooob – Moonshot/Kimi K2.6
- @aniaan – Moonshot thinking.keep
- @omarshahine – BlueBubbles group systemPrompt
- @mbelinky – Plugins/tasks
- @bulutmuf – Terminal logging
- @joshavant – QA/CI
- @ninjaa – Mattermost streaming
- @amknight – Plugins/tests
- @vincentkoc – npm node-domexception
📝 Wrap-Up
OpenClaw 2026.4.20/4.21 double release:
- gpt-image-2 as the OpenAI default, with 2K/4K support
- Kimi K2.6 as the Moonshot default
- Session OOM protection
- Hardened auth
- Mattermost streaming output
- BlueBubbles group systemPrompt
- Wizard styling improvements
- Multiple Slack/Browser/npm fixes
- 16+ contributors involved
OpenClaw keeps iterating and gets better every day.
GitHub Releases:https://github.com/openclaw/openclaw/releases