Andrew Ng Just Released OpenWorker: An Open-Source, Local-First Desktop AI Coworker That Returns Finished Deliverables Instead of Chat

Andrew Ng has announced OpenWorker, an open-source desktop agent that produces completed work slightly than dialog. OpenEmployee asks the person for an final result, not a immediate: a elegant doc, a Slack reply containing the precise numbers, an up to date calendar, a triaged inbox. It then breaks that final result into steps, works throughout native information and related apps, and checks in earlier than something consequential.

The structure is 4 layers, and all of them run in your machine

The repository accommodates 119 Python information (~32,400 strains) underneath coworker/, 149 TypeScript/TSX information underneath surfaces/gui/, and 78 backend take a look at modules.

The stack breaks down as follows:

Desktop shell — a Tauri 2 native window wrapping a React 18 UI. The bundle identifier is com.openworker.desktop, and the shell supervises the Python server itself.
Local agent server — Python 3.10+ on FastAPI and uvicorn, binding to 127.0.0.1:8765 by default. The instance config caps a flip at 12 mannequindevice iterations.
Capability and connector layer — vetted native instruments (information, git, ripgrep-backed search, shell, todo) plus hosted integrations plus MCP.
Model router — one interface over native, OpenAI-compatible, reseller and native suppliers.

The engine is constructed on aisuite, Andrew Ng’s provider-agnostic LLM library.

Bring your personal mannequin, from a intentionally small curated checklist

There is not any OpenEmployee inference service. The person pastes an API key, or factors the app at an area runtime.

The curated mannequin matrix accommodates precisely 30 entries. Native suppliers cowl OpenAI (GPT-5.6 Sol/Terra/Luna and GPT-5.5), Anthropic (Claude Fable 5, Opus 4.8, Sonnet 4.6, Haiku 4.5) and Google (Gemini 3.1 Pro, 3.6 Flash, 2.5 Pro, 2.5 Flash). OpenAI-compatible distributors add GLM-5.2, DeepSeek V4, Kimi K2.6, MiniMax M2.5, Qwen3 Max, Grok 4.3 and Mistral Large. Open-weight fashions arrive by way of Together AI and Fireworks, and absolutely native fashions by way of Ollama, which requires no key in any respect.

The permission engine is the precise engineering story

Most desktop agent tasks deal with approvals as a UI afterthought. OpenEmployee treats them as a typed layer.

Every device name is assessed into one of 4 threat lessons: learn (no negative effects), write_local (mutates the workspace, path-scoped), exec (runs instructions), and exterior (negative effects off the machine). Five permission modes then determine what occurs: focus on and plan are read-only, interactive is the default and asks earlier than writes, instructions and exterior actions, auto permits every thing whereas remaining path-scoped, and customized auto-approves a user-listed set of instruments.

Two design choices stand out.

First, unattended mode doesn’t elevate the autonomy ceiling — it solely modifications the place the human is reached. Prompts that would seem inline are routed to an Inbox, and the session suspends till answered.
Second, task-scoped standing guidelines are restricted to exterior threat solely. Shell instructions ask eternally, by design.

The built-in ops persona additionally instructs the mannequin to deal with content material from instruments, logs, the net, information and incoming messages as untrusted knowledge slightly than directions. That is an express prompt-injection posture, written into the shipped persona.

Privacy: local-first

Model calls go immediately from the machine to the configured supplier. Conversations, connector tokens and mannequin keys keep native, and the key retailer is designed in order that secrets and techniques by no means enter the mannequin’s context, prompts or traces.

The solely cloud part is an optionally available dealer that handles OAuth handshakes for one-click connectors, utilizing Auth0 Authorization Code with PKCE. Connector tokens are handed straight to the machine and are by no means saved within the cloud. The app is absolutely purposeful signed out, utilizing manually pasted credentials.

Key Takeaways

OpenEmployee is Andrew Ng’s MIT-licensed desktop AI coworker that returns completed deliverables, not chat replies.
The stack is a Tauri 2 + React shell over an area Python FastAPI agent server constructed on aisuite.
Model entry is bring-your-own-key throughout 30 curated tool-calling fashions, plus absolutely native Ollama.
A typed threat engine (learn/write_local/exec/exterior) gates each motion throughout 5 permission modes.

Check out the GitHub Repo, the project site, and the announcement. All credit score for this analysis goes to the researchers and builders of this mission.

The submit Andrew Ng Just Released OpenWorker: An Open-Source, Local-First Desktop AI Coworker That Returns Finished Deliverables Instead of Chat appeared first on MarkTechPost.