OpenWorker Open-Sources Desktop Agent: Stores Credentials Locally and Connects to More Than 25 Work Tools Through Approval Gates

Andrew Ng’s team has released OpenWorker under the MIT License, keeping the agent loop, credentials, and conversations on the user’s computer while supporting cloud models and local models via Ollama. It can generate files and operate Slack, calendars, and terminals, but “local-first” does not necessarily mean data never leaves the device.

Richard Bartz, Munich Makro Freak & Beemaster Hubert Seibring, Munich which gave me advice and a protection suite ;) My dog caught 6 bee-stings on the nose, i caught 4. · CC BY-SA 2.5 · Image source

2026-07-25zh-Hant

Andrew Ng’s team released the OpenWorker beta on July 23, turning the AI assistant from a chat interface into a desktop agent capable of delivering documents, spreadsheets, and reports or performing actions across services. The project is licensed under the MIT License; roughly two days after its release, its GitHub page showed more than 3,000 stars, reflecting continued strong developer demand for local agents.

The system consists of a local Python agent server and a desktop shell built with React and Tauri, with aisuite’s unified model interface underneath. The agent can read and write local files and use the terminal, while built-in connectors or MCP provide access to services including GitHub, Slack, Jira, Notion, Linear, email, and calendars. For models, users can supply their own API keys for OpenAI, Anthropic, Gemini, and others, or connect to Ollama instead. This layered architecture allows the model, tools, and interface to be replaced independently without locking workflows to a single vendor.

The security design centers on action-level approvals: actions such as sending messages, modifying calendars, and executing commands are paused in an approval queue by default. Scheduled tasks also cannot bypass the gate when running unattended. For enterprises, this is easier to audit than merely instructing the model in a prompt to “ask first.” However, OpenWorker’s description of itself as local-first has limits: connector tokens and model keys are stored on the device, but when cloud models or SaaS tools are used, required content is still sent to the corresponding services. OAuth also uses a cloud intermediary to complete the handshake.

The project remains a rapidly evolving beta. The Windows installer has not yet been code-signed, and arbitrary additional models configured by users may not offer reliable tool-calling capabilities. Engineering teams evaluating it should next verify that approvals cover every side effect, connector permissions can be minimized, and prompt injection in emails or documents cannot manipulate the agent into proposing dangerous actions.