OpenWorker: Andrew Ng's Open-Source Desktop AI Agent That Delivers Finished Work, Not Chat

• Desktop Shell: A Tauri 2 native window wrapping a React 18 user interface (bundle ID com.openworker.desktop). This shell also supervises the Python server process.
• Local Agent Server: Built on Python 3.10+ using FastAPI with Uvicorn, this server binds to 127.0.0.1:8765 on the local machine. It has a default cap of 12 model-tool iterations per task.
• Capability & Connector Layer: This layer provides a set of local tools for interacting with the filesystem, git, ripgrep-backed search, the shell, and to-do lists. It also includes hosted integrations and support for the Model Context Protocol (MCP).
• Model Router: The core model interface is built on aisuite, Andrew Ng's own provider-agnostic LLM library. This allows OpenWorker to provide a single, unified interface across native, OpenAI-compatible, reseller, and local model providers . The repository contains 119 Python files (~32,400 lines) under coworker/, 149 TypeScript/TSX files under surfaces/gui/, and 78 backend test modules .

Supported Models: 30 Curated, Bring-Your-Own-Key

OpenWorker does not lock users into a single provider. It supports 30 curated models across multiple categories, all of which require the user to bring their own API key (BYOK) . The supported models include:

• Native Providers: OpenAI GPT-5.6 Sol, Terra, Luna, GPT-5.5; Anthropic Claude Fable 5, Opus 4.8, Sonnet 4.6, Haiku 4.5; Google Gemini 3.6 Flash, 3.1 Pro, 2.5 Pro, 2.5 Flash.
• OpenAI-Compatible Vendors: GLM-5.2, DeepSeek V4, Kimi K2.6, MiniMax M2.5, Qwen3 Max, Grok 4.3, Mistral Large.
• Hosted Open-Weight Models: Available via partners like Together AI and Fireworks.
• Fully Local Models: Accessible through Ollama, which requires no API key.

The Permission & Safety System

One of OpenWorker's key features is its approach to safety. Every tool call an agent makes is classified into one of four risk tiers :

1. read — viewing local data (no side effects)
2. write_local — creating or modifying files on the machine (path-scoped)
3. exec — running shell commands
4. external — sending data off the machine (e.g., to Slack, email, or calendar)

These tiers are then controlled through five permission modes :

1. discuss — read-only discussion
2. plan — read-only planning
3. interactive (default) — asks the user before performing writes, commands, and external actions
4. auto — allows everything while remaining path-scoped
5. custom — auto-approves a user-specified set of tools

Prompt-Injection Defense

To protect against prompt injection attacks, OpenWorker includes a built-in "ops persona" that instructs the model to treat content from tools, logs, files, and incoming messages as untrusted data rather than instructions. This defense is written directly into the shipped persona configuration .

Privacy-First Design

OpenWorker is designed with strong privacy principles :

• Model calls route directly from the user's machine to the chosen provider — there is no intermediary relay server.
• Conversations, connector tokens, and API keys stay local. The secret store is architected so that secrets never enter the model context, prompts, or traces.
• The only optional cloud component is an OAuth broker (using Auth0 Authorization Code with PKCE) for one-click connector handshakes. Connector tokens are handed directly to the machine and are never stored in the cloud.
• The app works fully offline when API keys and credentials are pasted manually.

Platform Support and Current Status

OpenWorker currently runs on Mac, with Windows support listed as "coming soon" . The project is in open beta and is described as fully usable, with self-updating capabilities .

The End of the Chatbot Paradigm

OpenWorker is explicitly positioned as a shift from the chatbot model. Instead of prompting a conversation, a user specifies a desired outcome (e.g., "triaged inbox," "polished document," "Slack reply with Q3 numbers," "updated calendar entry"). The agent then breaks that goal into steps, works across local files and connected applications, and pauses for human approval before taking consequential actions . It supports over 25 integrations plus MCP, covering tools like Telegram, GitHub, Slack, Jira, Notion, Linear, HubSpot, Outlook, Gmail, and Google Calendar .