# OpenWorker

> Source: https://aiwiki.ai/wiki/openworker
> Updated: 2026-08-27
> Fact-checked: 2026-08-27
> Categories: AI Agents, AI Tools & Products, Developer Tools, Open Source AI
> License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) - attribute to "AI Wiki (aiwiki.ai)"
> Cite as: AI Wiki. "OpenWorker." aiwiki.ai, 27 Aug 2026. https://aiwiki.ai/wiki/openworker
> From AI Wiki (https://aiwiki.ai), the free encyclopedia of artificial intelligence. Reuse freely with attribution.

**OpenWorker** is an open-source, local-first desktop [AI agent](https://aiwiki.ai/wiki/ai_agents) announced by [Andrew Ng](https://aiwiki.ai/wiki/andrew_ng). It combines a desktop interface with a local agent server that can work with files, a terminal, and connected services. The project is designed to return a completed artifact or carry out an approved action, rather than limit its output to a chat response.[1][2][4][12]

OpenWorker remains in open beta. Its v0.2 series introduced reusable skills, memory, an optional reviewer for tool approvals, and three security-focused coworkers. The latest tagged release checked on August 27, 2026 was v0.2.1.[4][5][6]

## Key facts

| Field | Detail |
| --- | --- |
| Project | OpenWorker[2][4] |
| Repository | `andrewyng/openworker`[4] |
| Announced by | Andrew Ng[1][12] |
| Status | Open beta[4] |
| Current release discussed here | v0.2.1, published August 25, 2026[6] |
| Application design | Tauri desktop shell and React interface over a local Python agent server[4] |
| Model access | User-supplied provider keys, open-weight providers, or local inference through Ollama[2][4] |
| Extensibility | More than 25 documented integrations, local tools, and MCP servers[4] |
| License | MIT License[11] |

## Development and releases

Independent reporting described OpenWorker's public release in July 2026 as a desktop agent built around a Tauri and React interface, a Python server, connectors, and a model router. Those architectural details match the current public repository.[4][12]

Version 0.2.0 was published on August 24, 2026. It added instruction packages called skills, project-bound memory, guided setup for the [Model Context Protocol](https://aiwiki.ai/wiki/model_context_protocol), an auto-approve reviewer mode, and three security coworkers. Its release notes also report fixes for scheduled-task handling across daylight-saving changes and weekday rules, approval gating for Git clone and pull operations, private permissions for secrets files, pinned web-fetch connections, updated MCP dependencies, and other workspace-trust and approval fixes.[5]

Version 0.2.1 followed on August 25. It added Ox Alpha to the model picker through [OpenRouter](https://aiwiki.ai/wiki/openrouter). The release page identified v0.2.1 as the latest tagged version when checked on August 27.[6]

## Architecture and local-first design

The desktop application uses a Tauri native shell with a React interface. The shell supervises a Python server running on the same computer. The repository places the agent engine, provider adapters, connectors, MCP client, memory, and automation code in that server. OpenWorker builds this engine on aisuite, a Python library for accessing multiple model providers through a common interface.[4]

This arrangement supports [computer use](https://aiwiki.ai/wiki/computer_use) without requiring OpenWorker to operate a hosted agent loop. The project's privacy policy says that conversations, prompts, generated files, model keys, and connector tokens are stored on the user's device rather than on OpenWorker's servers. One-click connector setup can use an optional cloud service for sign-in and OAuth handshakes, while manually supplied credentials can be used without an OpenWorker account.[3][4]

Local-first does not mean that every task remains on the device. The privacy policy says that conversation content goes directly from the computer to the configured cloud model provider. Content from connected services can also be sent to that provider when needed for a requested task. Real-time connector events may pass through an OpenWorker relay for delivery, and remote services receive the data required by their operations. These are statements in the project's policy, not findings from an independent privacy audit.[3]

Local inference through [Ollama](https://aiwiki.ai/wiki/ollama) avoids sending model prompts to a cloud model provider. A task can still communicate with remote services if it uses email, Slack, GitHub, a web tool, or another networked connector.[2][3][4]

## Models and connectors

The current README lists native or supported access to OpenAI, Anthropic, Google Gemini, BytePlus Ark, Volcengine Ark Agent Plan, Inkling, GLM, DeepSeek, Kimi, Qwen, MiniMax, Mistral, and Grok. It also lists Together and Fireworks for open-weight models and Ollama for models run locally. The project maintains a curated list of models its developers have checked for tool-calling work, while allowing unlisted model strings at the user's risk.[4]

OpenWorker's documentation advertises more than 25 integrations. Examples include GitHub, Slack, Jira, Notion, Linear, HubSpot, Outlook, monday.com, Gmail, and Google Calendar. Local files and the terminal are also tools. MCP servers can add further tools, with approval behavior configured per tool.[2][4]

Connector credentials are kept in the local secret store according to the privacy policy. For managed connections, the optional OAuth broker handles the sign-in exchange and passes the token to the device. The policy says the broker does not retain those tokens. This design still depends on the privacy and security behavior of the selected model provider and connected services.[3]

## Approvals and scheduled work

Project documentation describes consequential actions such as sending a message, changing a calendar entry, writing outside granted locations, and running commands as approval-gated. Its control model has several levels: one-time approval, standing rules, configuration allowlists, and an optional model reviewer for routine calls. The README says a set of developer-defined human-only floors remains outside reviewer and bypass approval paths.[4]

In auto-approve mode, a reviewer model examines calls that would otherwise request approval. Uncertain calls are sent to the user, and repeated denials can pause the reviewer for the rest of the turn. The documentation calls these verdicts judgments rather than guarantees. It also says that tool-call records preserve whether a call was approved by a user, approved by the reviewer, or denied, together with the recorded reason.[4]

These controls implement a form of [human-in-the-loop](https://aiwiki.ai/wiki/human_in_the_loop) operation, but the public documentation does not demonstrate that every bypass or [prompt injection](https://aiwiki.ai/wiki/prompt_injection) attempt will be stopped. The project's security policy treats bypasses of human-only floors or approval gates as high-severity vulnerabilities, which defines the intended boundary without independently validating it.[4][10]

OpenWorker can schedule recurring tasks such as briefs or reports. Runs and transcripts appear in the application. The README says unattended runs cannot approve their own blocked actions; requests wait in an inbox for a person. Version 0.2.0 specifically fixed daylight-saving and weekday-rule behavior in scheduled automations.[4][5]

## Security coworkers in v0.2

Version 0.2.0 added three specialist configurations for development security. Each is a bundled persona with named tools and workflow instructions. They combine conventional scanners with model-based triage and drafting.[5]

| Coworker | Documented workflow | Intended human checkpoint |
| --- | --- | --- |
| Security Coworker | Runs Semgrep and Gitleaks when available, reads the surrounding code, classifies findings by reachability and impact, avoids printing secret values, and prepares focused fixes with tests[7] | Installing a missing scanner requires approval; fix pull requests are prepared for review rather than merged by the coworker[7] |
| Cloud Posture Coworker | Scans infrastructure code with Trivy or Checkov, uses read-only AWS queries, compares live configuration with Terraform, and drafts changes in code[8] | It is instructed not to write to the cloud or run `terraform apply`; a team reviews and applies the proposed infrastructure change[8] |
| Dependency Audit Coworker | Uses tools such as osv-scanner, npm audit, pip-audit, or Trivy, checks whether vulnerable code is reachable, chooses the smallest closing upgrade, and runs the project's install, build, and tests[9] | It prepares focused upgrade pull requests and is instructed not to merge them, especially when tests fail[9] |

The Security Coworker's instructions distinguish scanner output from the model's role. Scanners provide findings; the model reads code context, ranks the findings, drafts fixes, and records which checks could not run. Its secret-scan workflow calls for credential rotation before code removal and prohibits putting secret values in output or pull requests.[7]

The Cloud Posture workflow makes a similar distinction between observation and change. It permits read-only account queries and directs remediation into infrastructure code. The Dependency Audit workflow ranks advisories by documented reachability rather than severity alone and asks for the smallest available upgrade that closes the advisory.[8][9]

These files specify intended behavior, not measured effectiveness. The sources used for this article contain no independent penetration test, certified audit, benchmark of vulnerability-detection coverage, or evaluation of fix quality. Results depend on the selected model, installed scanners, project structure, configuration, credentials, and the quality of human review.[7][8][9]

## Open-source status and security policy

OpenWorker is an [open-source AI](https://aiwiki.ai/wiki/open_source_ai) tool published under the MIT License. The license permits use, modification, and redistribution subject to retaining its copyright and permission notice, and it provides the software without warranty.[11]

The repository's security policy covers the desktop app, local server, permission and reviewer flow, audit trail, and the OAuth broker used by managed connectors. It asks researchers to report vulnerabilities privately, supports only the latest release, and states that there is no bug bounty program.[10]

Because the project is an open beta, its documented safeguards should be read as design claims and current implementation goals. Choosing a local model can reduce one external data path, but model choice alone does not remove risks from connectors, third-party MCP servers, local command execution, or incorrect model judgments.[3][4][10]

## References

1. Andrew Ng. Post announcing the OpenWorker security-workflow update. X, Aug. 25, 2026. https://x.com/AndrewYNg/status/2092315079576555806
2. OpenWorker. "AI that gets your everyday tasks done." Accessed Aug. 27, 2026. https://openworker.com/
3. OpenWorker. "Privacy Policy." Effective July 17, 2026; accessed Aug. 27, 2026. https://openworker.com/privacy.html
4. Andrew Ng. "OpenWorker" repository and README. GitHub, main branch at commit 86c57f0692a5a318e55d1b9e0188d798b9fc5690, accessed Aug. 27, 2026. https://github.com/andrewyng/openworker
5. OpenWorker. "OpenWorker v0.2.0." GitHub Releases, Aug. 24, 2026. https://github.com/andrewyng/openworker/releases/tag/v0.2.0
6. OpenWorker. "OpenWorker v0.2.1." GitHub Releases, Aug. 25, 2026. https://github.com/andrewyng/openworker/releases/tag/v0.2.1
7. OpenWorker. "Security Coworker" manifest and bundled skills, v0.2.1. GitHub. https://github.com/andrewyng/openworker/tree/v0.2.1/coworker/personas/builtin/security
8. OpenWorker. "Cloud Posture Coworker" manifest and bundled skills, v0.2.1. GitHub. https://github.com/andrewyng/openworker/tree/v0.2.1/coworker/personas/builtin/cloud-posture
9. OpenWorker. "Dependency Audit Coworker" manifest and bundled skills, v0.2.1. GitHub. https://github.com/andrewyng/openworker/tree/v0.2.1/coworker/personas/builtin/dep-audit
10. OpenWorker. "Security Policy." GitHub, accessed Aug. 27, 2026. https://github.com/andrewyng/openworker/blob/main/SECURITY.md
11. Andrew Ng. "MIT License." OpenWorker repository, GitHub, accessed Aug. 27, 2026. https://github.com/andrewyng/openworker/blob/main/LICENSE
12. Asif Razzaq. "Andrew Ng Just Released OpenWorker: An Open-Source, Local-First Desktop AI Coworker That Returns Finished Deliverables Instead of Chat." MarkTechPost, July 23, 2026. https://www.marktechpost.com/2026/07/23/andrew-ng-just-released-openworker-an-open-source-local-first-desktop-ai-coworker-that-returns-finished-deliverables-instead-of-chat/