Andrew Ng ships OpenWorker, an AI agent that does your work instead of just chatting

Andrew Ng just released OpenWorker, and it’s built around a deceptively simple idea: ask for an outcome, not a prompt. You don’t tell it what to say — you tell it what to produce. A polished document. A Slack reply with the actual numbers pulled from a spreadsheet. A triaged inbox. A meeting that’s actually on your calendar.

Under the hood, it’s a four-layer architecture that runs entirely on your machine. The desktop shell uses Tauri 2 wrapping a React 18 UI, and it supervises a local Python FastAPI server that binds to 127.0.0.1:8765. The engine is built on aisuite, Ng’s provider-agnostic library, and it ships with a curated matrix of exactly 30 models — from GPT-5.6 and Claude Opus 4.8 to Gemini 3.1 Pro and DeepSeek V4. You bring your own keys. Or point it at Ollama and use no key at all.

What actually sets this apart isn’t the model routing. It’s the permission engine. Most desktop agents treat approvals as an afterthought — a yes/no popup. OpenWorker classifies every tool call into a risk class: read, write_local, exec, or external. Then five permission modes decide what happens. The default is interactive, which asks before writes and command execution. Unattended mode doesn’t grant more autonomy; it just reroutes prompts to an Inbox and suspends until you answer. Shell commands ask forever, by design.

Ng’s team also baked in an explicit prompt-injection defense. The built-in ops persona instructs the model to treat everything from tool outputs to web content as untrusted data — not instructions. That’s a posture most agent projects hand-wave away. Privacy follows the same philosophy: model calls go directly from your machine to the provider, secrets never enter the model’s context, and the only cloud piece is an optional OAuth broker that hands tokens straight to your device. It works fully signed out. The whole thing is MIT-licensed. You can fork it and run it however you want.