Andrew Ng’s OpenWorker is a new open-source, local-first AI desktop agent that completes tasks instead of simply chatting. It executes workflows across files and connected apps using a permission-based security system, supports 30 AI models, keeps data on-device, and lets users bring their own API keys. Its privacy-first architecture and MIT license make it a compelling option for developers and businesses.
Andrew Ng released OpenWorker this week. It’s an open-source, local-first desktop agent, and it works on a different premise than most AI assistants. It doesn’t hand back a conversation. It hands back a completed task.
You give it a goal — a polished document, a Slack reply with real numbers already in it, an updated calendar, a cleaned-out inbox. OpenWorker plans the steps. It works across your local files and connected apps. It checks in only when something consequential is about to happen.
That framing puts OpenWorker in a different category than typical copilots. Most AI tools return text and leave you to execute on it. OpenWorker executes and hands back the result. That shifts the key question from “how good are the answers” to “how much can I trust it to act.”
Why It Matters
The gap between “AI that talks” and “AI that does” has slowed agentic AI down for two years now. Plenty of frameworks can chain tool calls. Few ship a permission model detailed enough that a user would actually let one run unsupervised on their own machine.
OpenWorker bets that the missing piece isn’t a smarter model. It’s the plumbing around the model: a typed risk system, a local-only data path, and a UI built for outcomes instead of chat turns. If that bet pays off, it will reshape what developers and knowledge workers expect from desktop agents generally — not just from this one project.
Technical Details: A Four-Layer, Fully Local Stack
The repository is sizable. It holds roughly 119 Python files (about 32,400 lines) under coworker/, 149 TypeScript/TSX files under surfaces/gui/, and 78 backend test modules. The architecture splits into four layers, and all of them run on the user’s own machine rather than a hosted backend:
- Desktop shell — a Tauri 2 window wraps a React 18 interface, packaged under the bundle identifier
com.openworker.desktop. The shell also supervises the Python server process, rather than treating it as an external dependency. - Local agent server — a Python 3.10+ service runs on FastAPI and uvicorn, bound by default to
127.0.0.1:8765. The shipped example configuration caps a single turn at 12 model-to-tool iterations, which guards against runaway loops. - Capability and connector layer — this includes vetted local tools (file access, git, ripgrep-based search, shell, todo management), plus hosted integrations and MCP connectors.
- Model router — a single interface spans native, OpenAI-compatible, reseller, and local model providers. It’s built on top of
aisuite, Ng’s own provider-agnostic LLM library.
The team chose to run the shell, server, and tool layer entirely on-device, rather than routing through a hosted OpenWorker backend. That choice makes a design statement. It trades the convenience of a managed service for direct control over what data leaves the machine, and it lines up with the project’s stated privacy posture (more on that below).
Model Access: Bring Your Own Key, From a Curated List
OpenWorker has no inference service of its own. Users paste in an API key for a supported provider, or they point the app at a local runtime.
The curated matrix lists exactly 30 models. Native provider support covers OpenAI (GPT-5.6 Sol, Terra, and Luna, plus GPT-5.5), Anthropic (Claude Fable 5, Opus 4.8, Sonnet 4.6, and Haiku 4.5), and Google (Gemini 3.1 Pro, 3.6 Flash, 2.5 Pro, and 2.5 Flash). OpenAI-compatible endpoints add GLM-5.2, DeepSeek V4, Kimi K2.6, MiniMax M2.5, Qwen3 Max, Grok 4.3, and Mistral Large. Together AI and Fireworks provide access to open-weight models, and Ollama offers a fully local, keyless path.
Some teams need to standardize on one vendor, often for compliance or cost reasons. For them, this model-agnostic router may matter more than any single capability of the agent loop. It means OpenWorker’s usefulness doesn’t depend on one lab’s models.
Performance and Evidence: The Permission Engine Is the Real Story
There are no benchmark scores to report here. The notable engineering claim is architectural instead. Most desktop agent projects bolt approvals onto the UI as an afterthought. OpenWorker builds permissions into the core as a typed system.
The system classifies every tool call into one of four risk tiers: read (no side effects), write_local (path-scoped workspace mutations), exec (command execution), and external (effects outside the machine). Five permission modes then govern behavior. Discuss and plan stay read-only. Interactive, the default, asks before writes, commands, or external actions. Auto allows everything while remaining path-scoped. Custom auto-approves a user-specified tool list.
Two decisions in that design stand out. First, unattended operation doesn’t raise what the agent can do. It only changes where the system asks a human. Inline prompts get rerouted to an Inbox, and the session pauses until someone answers. Second, standing rules that skip repeated approval only apply to external-risk actions. Shell commands always ask, by design, with no auto-approve escape hatch.
The built-in “ops” persona adds one more safeguard. It instructs the model to treat everything from tools, logs, the web, files, and incoming messages as untrusted data, not as instructions to follow. That’s an explicit, shipped defense against prompt injection, and it signals real engineering maturity. Still, a persona-level instruction is a mitigation, not a guarantee. Independent red-teaming would show how well it holds up against adversarial content.
Pricing and Availability
OpenWorker carries an MIT license, and you can get it now on GitHub, alongside a project site and the announcement post. It’s bring-your-own-key, so there’s no OpenWorker subscription fee. You pay whatever your chosen model provider charges — or nothing, if you run it fully local through Ollama.
Privacy and Data Flow
Model calls go straight from your machine to whichever provider you configure. Your conversations, connector tokens, and model keys all stay local. The secret store keeps credentials out of the model’s context, prompts, and traces, which limits the risk of a key leaking through a tool call or a logged transcript.
One component does touch the cloud: an optional broker that handles OAuth handshakes for one-click connectors, using Auth0’s Authorization Code flow with PKCE. Even there, connector tokens go straight to your local machine, and the cloud never retains them. The app works fully signed out, too, using manually pasted credentials.
Industry Implications
For developers and technical decision-makers, OpenWorker adds a genuinely open, self-hostable option to a field full of closed, hosted, per-seat “AI coworker” products. That matters for teams with data-residency requirements, or for anyone who prefers auditable code over a vendor’s word.
For the open-source ecosystem, a permission-typed agent loop under an MIT license gives other projects a reference to fork or critique. That tends to raise the baseline for what “safe by default” means across agentic tooling generally.
Limitations and Open Questions
These specifics come from the project’s own repository, documentation, and announcement — not from independent benchmarking. Nobody has yet verified, outside the project, how well the injection defenses hold up, how the 12-iteration cap performs on genuinely complex multi-app tasks, or how the connector layer behaves at scale. As with any bring-your-own-key tool, output quality will also vary a lot depending on which of the 30 supported models you pick.
Future Outlook
The real test for OpenWorker will come from developers who run it against messy, multi-step workflows, not demos. Security researchers will also need to probe the permission engine and the prompt-injection defenses directly. If the architecture holds up under that scrutiny, it offers a plausible template for how builders make local-first agentic tools going forward — not just a one-off release. Anyone evaluating it for real workflows should watch for independent audits of the permission system, and for early community reports on reliability across the 30-model matrix, before they commit production tasks to it.