Andrew Ng Just Released OpenWorker: An Open-Source, Local-First Desktop AI Coworker That Returns Finished Deliverables Instead of Chat

Andrew Ng has announced OpenWorker , an open-source desktop agent that produces finished work rather than conversation. OpenWorker asks the user for an outcome , not a prompt: a polished document, a Slack reply containing the actual numbers, an updated calendar, a triaged inbox. It then breaks that outcome into steps, works across local files and connected apps, and checks in before anything consequential.

The repository contains 119 Python files (~32,400 lines) under coworker/ , 149 TypeScript/TSX files under surfaces/gui/ , and 78 backend test modules.

The engine is built on aisuite , Andrew Ng’s provider-agnostic LLM library.

There is no OpenWorker inference service. The user pastes an API key, or points the app at a local runtime.

The curated model matrix contains exactly 30 entries. Native providers cover OpenAI (GPT-5.6 Sol/Terra/Luna and GPT-5.5), Anthropic (Claude Fable 5, Opus 4.8, Sonnet 4.6, Haiku 4.5) and Google (Gemini 3.1 Pro, 3.6 Flash, 2.5 Pro, 2.5 Flash). OpenAI-compatible vendors add GLM-5.2, DeepSeek V4, Kimi K2.6, MiniMax M2.5, Qwen3 Max, Grok 4.3 and Mistral Large. Open-weight models arrive through Together AI and Fireworks , and fully local models through Ollama , which requires no key at all.

Most desktop agent projects treat approvals as a UI afterthought. OpenWorker treats them as a typed layer.

Every tool call is classified into one of four risk classes: read (no side effects), write_local (mutates the workspace, path-scoped), exec (runs commands), and external (side effects off the machine). Five permission modes then decide what happens: discuss and plan are read-only, interactive is the default and asks before writes, commands and external actions, auto allows everything while remaining path-scoped, and custom auto-approves a user-listed set of tools.

The built-in ops persona also instructs the model to treat content from tools, logs, the web, files and incoming messages as untrusted data rather than instructions. That is an explicit prompt-injection posture, written into the shipped persona.

Model calls go directly from the machine to the configured provider. Conversations, connector tokens and model keys stay local, and the secret store is designed so that secrets never enter the model’s context, prompts or traces.

The only cloud component is an optional broker that handles OAuth handshakes for one-click connectors, using Auth0 Authorization Code with PKCE. Connector tokens are handed straight to the machine and are never stored in the cloud. The app is fully functional signed out, using manually pasted credentials.