OpenWorker: Andrew Ng's Open-Source Desktop AI Agent That Delivers Finished Work, Not Chat
OpenWorker is an MIT licensed, open source desktop AI agent by Andrew Ng that executes multi step tasks and returns finished deliverables — like polished documents or Slack messages — instead of conversational responses. Its four layer stack uses Tauri 2 for the desktop shell, Python FastAPI for the local agent serv...
Published byEdited with DeepSeek-V4-FlashImages generated with GPT Image 1.5
OpenWorker is an MIT licensed, open source desktop AI agent by Andrew Ng that executes multi step tasks and returns finished deliverables — like polished documents or Slack messages — instead of conversational responses.
Its four layer stack uses Tauri 2 for the desktop shell, Python FastAPI for the local agent server, a capability layer for tools and integrations, and Andrew Ng's own aisuite library as a provider agnostic model router.
Every action is gated by a four tier risk engine (read, write local, exec, external) and five permission modes, with a built in prompt injection defense that treats external content as untrusted.
Search & fact-check with cited sources for What is Andrew Ng's OpenWorker, and what are its key features including its architecture built onAn AI-generated concept visual of a local-first AI coworker.
AI Prompt
Create a landscape editorial hero image for this Studio Global article: Search & fact-check with cited sources for What is Andrew Ng's OpenWorker, and what are its key features including its architecture built on. Article summary: The search results from multiple high-quality sources provide thorough coverage of all the claims. Below is the verified answer.. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clickbait thumbnails, icons, and tiny thumbnail layouts. Make it useful as an il
openai.com
Andrew Ng, the renowned AI educator and researcher, has released a new open-source desktop application called OpenWorker that aims to move beyond the traditional AI chatbot paradigm. Announced on July 23, 2026, OpenWorker is an MIT-licensed, local-first AI agent designed to execute multi-step tasks and return finished work products — like a polished document, an updated calendar entry, or a Slack message containing specific data — instead of simple conversational replies . It is available on GitHub at and is currently in open beta .
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
What is the short answer to "OpenWorker: Andrew Ng's Open-Source Desktop AI Agent That Delivers Finished Work, Not Chat"?
OpenWorker is an MIT licensed, open source desktop AI agent by Andrew Ng that executes multi step tasks and returns finished deliverables — like polished documents or Slack messages — instead of conversational responses.
What are the key points to validate first?
OpenWorker is an MIT licensed, open source desktop AI agent by Andrew Ng that executes multi step tasks and returns finished deliverables — like polished documents or Slack messages — instead of conversational responses. Its four layer stack uses Tauri 2 for the desktop shell, Python FastAPI for the local agent server, a capability layer for tools and integrations, and Andrew Ng's own aisuite library as a provider agnostic model router.
What should I do next in practice?
Every action is gated by a four tier risk engine (read, write local, exec, external) and five permission modes, with a built in prompt injection defense that treats external content as untrusted.
OpenWorker: Andrew Ng's Open-Source Desktop AI Agent That Delivers Finished Work, Not Chat
OpenWorker is an MIT licensed, open source desktop AI agent by Andrew Ng that executes multi step tasks and returns finished deliverables — like polished documents or Slack messages — instead of conversational responses. Its four layer stack uses Tauri 2 for the desktop shell, Python FastAPI for the local agent serv...
Published byEdited with DeepSeek-V4-FlashImages generated with GPT Image 1.5
OpenWorker is an MIT licensed, open source desktop AI agent by Andrew Ng that executes multi step tasks and returns finished deliverables — like polished documents or Slack messages — instead of conversational responses.
Its four layer stack uses Tauri 2 for the desktop shell, Python FastAPI for the local agent server, a capability layer for tools and integrations, and Andrew Ng's own aisuite library as a provider agnostic model router.
Every action is gated by a four tier risk engine (read, write local, exec, external) and five permission modes, with a built in prompt injection defense that treats external content as untrusted.
Search & fact-check with cited sources for What is Andrew Ng's OpenWorker, and what are its key features including its architecture built onAn AI-generated concept visual of a local-first AI coworker.
AI Prompt
Create a landscape editorial hero image for this Studio Global article: Search & fact-check with cited sources for What is Andrew Ng's OpenWorker, and what are its key features including its architecture built on. Article summary: The search results from multiple high-quality sources provide thorough coverage of all the claims. Below is the verified answer.. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clickbait thumbnails, icons, and tiny thumbnail layouts. Make it useful as an il
openai.com
Andrew Ng, the renowned AI educator and researcher, has released a new open-source desktop application called OpenWorker that aims to move beyond the traditional AI chatbot paradigm. Announced on July 23, 2026, OpenWorker is an MIT-licensed, local-first AI agent designed to execute multi-step tasks and return finished work products — like a polished document, an updated calendar entry, or a Slack message containing specific data — instead of simple conversational replies . It is available on GitHub at and is currently in open beta .
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
What is the short answer to "OpenWorker: Andrew Ng's Open-Source Desktop AI Agent That Delivers Finished Work, Not Chat"?
OpenWorker is an MIT licensed, open source desktop AI agent by Andrew Ng that executes multi step tasks and returns finished deliverables — like polished documents or Slack messages — instead of conversational responses.
What are the key points to validate first?
OpenWorker is an MIT licensed, open source desktop AI agent by Andrew Ng that executes multi step tasks and returns finished deliverables — like polished documents or Slack messages — instead of conversational responses. Its four layer stack uses Tauri 2 for the desktop shell, Python FastAPI for the local agent server, a capability layer for tools and integrations, and Andrew Ng's own aisuite library as a provider agnostic model router.
What should I do next in practice?
Every action is gated by a four tier risk engine (read, write local, exec, external) and five permission modes, with a built in prompt injection defense that treats external content as untrusted.
OpenWorker runs entirely on the user's machine, with no inference server in the cloud. Its architecture is composed of four distinct layers :
Desktop Shell: A Tauri 2 native window wrapping a React 18 user interface (bundle ID com.openworker.desktop). This shell also supervises the Python server process.
Local Agent Server: Built on Python 3.10+ using FastAPI with Uvicorn, this server binds to 127.0.0.1:8765 on the local machine. It has a default cap of 12 model-tool iterations per task.
Capability & Connector Layer: This layer provides a set of local tools for interacting with the filesystem, git, ripgrep-backed search, the shell, and to-do lists. It also includes hosted integrations and support for the Model Context Protocol (MCP).
Model Router: The core model interface is built on aisuite, Andrew Ng's own provider-agnostic LLM library. This allows OpenWorker to provide a single, unified interface across native, OpenAI-compatible, reseller, and local model providers . The repository contains 119 Python files (~32,400 lines) under coworker/, 149 TypeScript/TSX files under surfaces/gui/, and 78 backend test modules .
Supported Models: 30 Curated, Bring-Your-Own-Key
OpenWorker does not lock users into a single provider. It supports 30 curated models across multiple categories, all of which require the user to bring their own API key (BYOK) . The supported models include:
Native Providers: OpenAI GPT-5.6 Sol, Terra, Luna, GPT-5.5; Anthropic Claude Fable 5, Opus 4.8, Sonnet 4.6, Haiku 4.5; Google Gemini 3.6 Flash, 3.1 Pro, 2.5 Pro, 2.5 Flash.
Hosted Open-Weight Models: Available via partners like Together AI and Fireworks.
Fully Local Models: Accessible through Ollama, which requires no API key.
The Permission & Safety System
One of OpenWorker's key features is its approach to safety. Every tool call an agent makes is classified into one of four risk tiers:
read — viewing local data (no side effects)
write_local — creating or modifying files on the machine (path-scoped)
exec — running shell commands
external — sending data off the machine (e.g., to Slack, email, or calendar)
These tiers are then controlled through five permission modes:
discuss — read-only discussion
plan — read-only planning
interactive (default) — asks the user before performing writes, commands, and external actions
auto — allows everything while remaining path-scoped
custom — auto-approves a user-specified set of tools
Prompt-Injection Defense
To protect against prompt injection attacks, OpenWorker includes a built-in "ops persona" that instructs the model to treat content from tools, logs, files, and incoming messages as untrusted data rather than instructions. This defense is written directly into the shipped persona configuration .
Privacy-First Design
OpenWorker is designed with strong privacy principles :
Model calls route directly from the user's machine to the chosen provider — there is no intermediary relay server.
Conversations, connector tokens, and API keys stay local. The secret store is architected so that secrets never enter the model context, prompts, or traces.
The only optional cloud component is an OAuth broker (using Auth0 Authorization Code with PKCE) for one-click connector handshakes. Connector tokens are handed directly to the machine and are never stored in the cloud.
The app works fully offline when API keys and credentials are pasted manually.
Platform Support and Current Status
OpenWorker currently runs on Mac, with Windows support listed as "coming soon". The project is in open beta and is described as fully usable, with self-updating capabilities .
The End of the Chatbot Paradigm
OpenWorker is explicitly positioned as a shift from the chatbot model. Instead of prompting a conversation, a user specifies a desired outcome (e.g., "triaged inbox," "polished document," "Slack reply with Q3 numbers," "updated calendar entry"). The agent then breaks that goal into steps, works across local files and connected applications, and pauses for human approval before taking consequential actions . It supports over 25 integrations plus MCP, covering tools like Telegram, GitHub, Slack, Jira, Notion, Linear, HubSpot, Outlook, Gmail, and Google Calendar .
OpenWorker runs entirely on the user's machine, with no inference server in the cloud. Its architecture is composed of four distinct layers :
Desktop Shell: A Tauri 2 native window wrapping a React 18 user interface (bundle ID com.openworker.desktop). This shell also supervises the Python server process.
Local Agent Server: Built on Python 3.10+ using FastAPI with Uvicorn, this server binds to 127.0.0.1:8765 on the local machine. It has a default cap of 12 model-tool iterations per task.
Capability & Connector Layer: This layer provides a set of local tools for interacting with the filesystem, git, ripgrep-backed search, the shell, and to-do lists. It also includes hosted integrations and support for the Model Context Protocol (MCP).
Model Router: The core model interface is built on aisuite, Andrew Ng's own provider-agnostic LLM library. This allows OpenWorker to provide a single, unified interface across native, OpenAI-compatible, reseller, and local model providers . The repository contains 119 Python files (~32,400 lines) under coworker/, 149 TypeScript/TSX files under surfaces/gui/, and 78 backend test modules .
Supported Models: 30 Curated, Bring-Your-Own-Key
OpenWorker does not lock users into a single provider. It supports 30 curated models across multiple categories, all of which require the user to bring their own API key (BYOK) . The supported models include:
Native Providers: OpenAI GPT-5.6 Sol, Terra, Luna, GPT-5.5; Anthropic Claude Fable 5, Opus 4.8, Sonnet 4.6, Haiku 4.5; Google Gemini 3.6 Flash, 3.1 Pro, 2.5 Pro, 2.5 Flash.
Hosted Open-Weight Models: Available via partners like Together AI and Fireworks.
Fully Local Models: Accessible through Ollama, which requires no API key.
The Permission & Safety System
One of OpenWorker's key features is its approach to safety. Every tool call an agent makes is classified into one of four risk tiers:
read — viewing local data (no side effects)
write_local — creating or modifying files on the machine (path-scoped)
exec — running shell commands
external — sending data off the machine (e.g., to Slack, email, or calendar)
These tiers are then controlled through five permission modes:
discuss — read-only discussion
plan — read-only planning
interactive (default) — asks the user before performing writes, commands, and external actions
auto — allows everything while remaining path-scoped
custom — auto-approves a user-specified set of tools
Prompt-Injection Defense
To protect against prompt injection attacks, OpenWorker includes a built-in "ops persona" that instructs the model to treat content from tools, logs, files, and incoming messages as untrusted data rather than instructions. This defense is written directly into the shipped persona configuration .
Privacy-First Design
OpenWorker is designed with strong privacy principles :
Model calls route directly from the user's machine to the chosen provider — there is no intermediary relay server.
Conversations, connector tokens, and API keys stay local. The secret store is architected so that secrets never enter the model context, prompts, or traces.
The only optional cloud component is an OAuth broker (using Auth0 Authorization Code with PKCE) for one-click connector handshakes. Connector tokens are handed directly to the machine and are never stored in the cloud.
The app works fully offline when API keys and credentials are pasted manually.
Platform Support and Current Status
OpenWorker currently runs on Mac, with Windows support listed as "coming soon". The project is in open beta and is described as fully usable, with self-updating capabilities .
The End of the Chatbot Paradigm
OpenWorker is explicitly positioned as a shift from the chatbot model. Instead of prompting a conversation, a user specifies a desired outcome (e.g., "triaged inbox," "polished document," "Slack reply with Q3 numbers," "updated calendar entry"). The agent then breaks that goal into steps, works across local files and connected applications, and pauses for human approval before taking consequential actions . It supports over 25 integrations plus MCP, covering tools like Telegram, GitHub, Slack, Jira, Notion, Linear, HubSpot, Outlook, Gmail, and Google Calendar .
