Andrew Ng Just Released OpenWorker: An Open-Source, Local-First Desktop AI Coworker That Returns Finished Deliverables Instead of Chat
MarkTechPost Asif Razzaq
Andrew Ng released OpenWorker, a free desktop AI agent that hands you finished work instead of chatty replies. It runs locally, plugs into your own AI models, and asks permission before doing anything risky.
Based on reporting by MarkTechPost, Asif Razzaq — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Andrew Ng has a new project, and it's not another chatbot. OpenWorker is an open-source desktop app that treats you like a manager, not a chat partner. You tell it what you want done — a cleaned-up inbox, a Slack message with real numbers in it, an updated calendar — and it figures out the steps, touches your local files and connected apps, and comes back to you only when something actually matters. No back-and-forth prompt engineering required.
Under the hood it's a fairly serious piece of software: a Tauri 2 desktop shell wrapping a React 18 interface, sitting on top of a Python FastAPI server that runs entirely on your own machine, listening on localhost by default. Ng built the model-routing layer on aisuite, his own provider-agnostic LLM library, which is how OpenWorker manages to support 30 different models — GPT-5.5 and GPT-5.6, Anthropic's Claude Opus and Sonnet lines, Google's Gemini 3.1 and 2.5 families, plus DeepSeek, Qwen3 Max, Grok 4.3, Mistral Large and others — without locking you into one vendor. There's no OpenWorker cloud brain. You paste in your own API key, or skip keys entirely and run something locally through Ollama.
The part that actually took engineering discipline is the permission system, and it's more thoughtful than what most agent projects ship. Every action the agent wants to take gets sorted into one of four risk buckets: reading something, writing to local files, running a shell command, or reaching out to the internet. Five permission modes then decide how much rope the agent gets, from a read-only planning mode up to a full-auto setting that still stays boxed inside your file paths. Crucially, letting the agent run unattended doesn't mean it gets to do more — it just means questions get queued into an inbox instead of interrupting you live, and the whole task pauses until you answer. Shell commands never get auto-approved no matter what mode you're in; that's a deliberate line Ng's team drew and refused to move.
There's also a quieter security decision baked into the system prompt: anything coming from tool output, log files, the web, or incoming messages is treated as untrusted data, never as instructions to follow. That's a direct, built-in defense against prompt injection, which is one of the more underappreciated failure modes in agentic systems right now.
Privacy-wise, OpenWorker keeps everything — conversations, connector tokens, model keys — on your machine, with model calls going straight from your computer to whichever provider you picked. The only thing that touches the cloud at all is an optional login broker for one-click OAuth connections, and even then the actual access tokens land only on your device. You can run the whole thing signed out, pasting credentials by hand, and lose nothing.
My take — AI-written commentary, not fact-checked reporting
I like this a lot more than the usual agent-wrapper release, mostly because Ng's team clearly spent their engineering budget on the permission model instead of the marketing copy. Shell commands that never get auto-approved, untrusted-by-default tool output, unattended mode that queues rather than escalates — that's someone who has actually thought about what goes wrong, not just what goes right. Bring-your-own-key, local-first, MIT-licensed: this is what a genuinely open agent should look like, and it's a useful contrast to the walled-garden agent products everyone else is shipping this year.
Read more about this at: MarkTechPost
