Good morning, Rich. Here's your agent platform research briefing for April 22nd, 2026.

OpenClaw 2026.4.20 just shipped — it was published to npm yesterday as version 2026.4.21. This is a broad release that touches onboarding, agent behavior, and gateway stability. The setup wizard got a visual overhaul with better disclaimer styling and loading spinners. The default system prompt was strengthened with clearer completion bias, live-state checks, and verification-before-final guidance. Cron got split into a separate jobs-state.json file so job definitions can stay git-tracked. And there's a new detached runtime registration contract for plugin executors. Notable defaults: Moonshot Kimi K2.6 is now the default bundled model for search and media understanding, and the Mattermost plugin now streams thinking and tool activity into a single draft post. One fix worth noting — the YOLO exec mode was silently broken for gateway-host exec in security-full mode, and that's been restored. If you haven't updated yet, 2026.4.21 is the one to grab.

Critical MCP design vulnerability. OX Security published a report identifying an architectural flaw in Anthropic's official MCP SDKs across Python, TypeScript, Java, and Rust. This isn't a simple bug — it's embedded in the protocol design itself. The flaw enables arbitrary command execution on any system running a vulnerable MCP implementation and could affect over 150 million downloads and up to 200,000 servers. OX confirmed successful command execution on six live production platforms including LiteLLM, LangChain, and IBM's LangFlow. The exploit surface includes unauthenticated UI injection in popular AI frameworks, zero-click prompt injection in AI IDEs like Windsurf and Cursor, and malicious marketplace distribution — nine out of eleven MCP registries were successfully poisoned with test payloads. At least ten CVEs resulted from the research. Anthropic declined to issue a protocol-level patch, calling the behavior expected, and did not object to publication. The irony: this comes days after Anthropic unveiled Claude Mythos for software security. OX recommends running MCP services in sandboxes, blocking public internet access to AI services with sensitive APIs, and treating all external MCP configuration as untrusted. This is worth taking seriously given our MCP-dependent infrastructure.

OpenAI launched ChatGPT Images 2.0 yesterday, powered by a new model called gpt-image-2. The big differentiator: this model uses the same reasoning pipeline as ChatGPT's text capabilities — it plans layouts before rendering, unlike previous models that treated image generation as a separate module. It's powered by the GPT-5.4 backbone and replaces both DALL-E 3 and the interim GPT Image 1.5. Key features include native visual reasoning, 2K resolution output, multi-image consistency across up to ten images in a single shot, and significantly improved text rendering in more than a dozen languages. For our image generation tooling, this is likely the model backing the gpt-image-2 integration in OpenClaw. The pricing and availability details are rolling out now.

That's the briefing for April 22nd. Three stories today — a solid OpenClaw release, a concerning MCP vulnerability, and OpenAI's next-gen image model. Stay sharp out there.