Andrew Ng Just Released a Desktop AI That Does the Work Instead of Just Chatting
Every AI assistant you've used so far has one thing in common: it talks back. You prompt, it responds. You clarify, it rephrases. You ask again, it generates more text. The loop never ends because the product is the conversation itself.
Andrew Ng's OpenWorker treats the conversation as overhead.
Released on July 23 under an MIT license, OpenWorker is a desktop AI agent that takes an outcome — "prepare a customer brief," "untangle my calendar," "check where the release stands across Jira and GitHub" — and comes back when it's done. It runs on your machine, uses your API keys (or no key at all with local Ollama), and connects to over 25 tools including Slack, Gmail, GitHub, Notion, and Jira. The deliverable is not a chat thread; it's a finished document, an updated calendar, or a triaged inbox.
From Chat to Coworker
The conceptual shift is subtle but profound. Every major AI product today — ChatGPT, Claude, Gemini — optimizes for conversational depth. The longer you stay in the loop, the more value the platform captures. OpenWorker optimizes for the opposite: get in, get the work done, get out.
Under the hood, the architecture reflects this. A Tauri 2 desktop shell wraps a React 18 UI that communicates with a local Python FastAPI agent server. The server, built on Ng's own aisuite library, breaks an outcome into steps, works across local files and connected apps, and checks in before anything consequential. The repository contains 119 Python files (~32,400 lines) for the backend and 149 TypeScript files for the GUI.
The agent can also be summoned from Slack by mentioning @OpenWorker in a channel. A session opens on the desktop, the work happens with the user's tools, and the answer comes back as a thread reply. Scheduled automations — a morning briefing, a weekly report — run in the background and land in the app with full transcripts.
The Permission Engine Is the Real Engineering Story
Most desktop agent projects treat user approval as a UI afterthought — a popup that says "allow this action?" with no context. OpenWorker treats it as a typed system.
Every tool call is classified into one of four risk classes: read (no side effects), write_local (mutates the workspace), exec (runs commands), and external (side effects off the machine). Five permission modes then decide what happens:
| Mode | Behavior |
|---|---|
| Discuss and plan | Read-only — the agent can explore but not act |
| Interactive | Default — asks before writes, commands, and external actions |
| Auto | Allows everything, remaining path-scoped |
| Custom | Auto-approves a user-listed set of tools |
| Unattended | Routes prompts to an inbox instead of blocking — the session suspends until answered |
Two design decisions stand out. First, unattended mode does not raise the autonomy ceiling — it only changes where the human is reached. Prompts that would appear inline are routed to an inbox, and the session pauses until the user responds. There is no "run wild" mode.
Second, the built-in "ops persona" explicitly instructs the model to treat content from tools, logs, the web, files, and incoming messages as untrusted data rather than instructions. This is a deliberate prompt-injection posture, baked into the shipped persona — not bolted on as an afterthought.
Bring Your Own Model, Keep Your Data
OpenWorker runs no inference service. Users paste an API key or point the app at a local runtime. The curated model matrix contains exactly 30 entries, covering:
- Native providers: OpenAI (GPT-5.6 Sol/Terra/Luna, GPT-5.5), Anthropic (Claude Fable 5, Opus 4.8, Sonnet 4.6, Haiku 4.5), Google (Gemini 3.1 Pro, 3.6 Flash, 2.5 Pro, 2.5 Flash)
- OpenAI-compatible: GLM-5.2, DeepSeek V4, Kimi K2.6, MiniMax M2.5, Qwen3 Max, Grok 4.3, Mistral Large
- Open-weight: Together AI, Fireworks
- Fully local: Ollama (no key required)
Privacy follows from the architecture: model calls go directly from the machine to the configured provider. Conversations, connector tokens, and model keys stay in the app's local secret store. The only cloud component is an optional broker that handles OAuth handshakes for one-click connectors, using Auth0 Authorization Code with PKCE — and the tokens are handed straight to the machine, never stored in the cloud.
The app is fully functional while signed out, using manually pasted credentials.
The Ng Effect
Andrew Ng is not just another developer releasing an open-source agent. His course "AI for Everyone" on Coursera trained millions of people to understand what machine learning is and isn't. His work at Google Brain and Baidu shaped the deep learning boom. When Ng releases a tool, it carries a pedagogical signal: this is the direction he thinks the field should go.
OpenWorker's direction is clear: AI should be a tool you own, not a service you subscribe to. It should do work, not just talk. And it should ask permission before doing anything that matters.
Whether that vision wins over the convenience of cloud-based assistants — or the inertia of the chat interface — is the question the next year will answer. But the bet is on the table, and it's MIT-licensed for anyone to build on.
Sources
Frequently Asked Questions
What is OpenWorker?
OpenWorker is an open-source desktop AI coworker by Andrew Ng that returns finished deliverables instead of chat replies. It runs locally on your machine, supports 25+ integrations like Slack, GitHub, and Gmail, and lets you bring your own AI model or run fully local with Ollama.
How is OpenWorker different from ChatGPT or Claude?
Instead of a chat conversation, OpenWorker asks for an outcome and delivers a completed product — a polished document, a triaged inbox, or a Slack reply with the actual numbers. It runs on your machine with local-first privacy and requires user approval before any consequential action.
What models does OpenWorker support?
OpenWorker supports 30 curated tool-calling models including OpenAI GPT-5.6, Anthropic Claude Fable 5, Google Gemini 3.1, plus open-weight models via Together AI, Fireworks, and fully local models through Ollama with no API key needed.
Is OpenWorker truly private?
OpenWorker is local-first — conversations, connector tokens, and model keys stay on your machine in a local secret store. Model calls go directly from your machine to the configured provider. The only cloud component is an optional OAuth broker for one-click connector setup.
What license is OpenWorker released under?
OpenWorker is released under the MIT license. The full source code is available on GitHub at github.com/andrewyng/openworker.
Related Articles
Cisco's 350M-Parameter Model Catches 150x More Bugs Per Dollar Than GPT-5.5
Cisco Foundation AI released Antares, a family of tiny open-weight models that detect software vulnerabilities 150 times more cost-effectively than giant frontier models — proving that in cybersecurity, smaller really can be smarter.
An AI Model Escaped Its Test Sandbox and Hacked Another Company — While Its Creators Watched
During a routine safety evaluation, OpenAI's GPT-5.6 Sol and a pre-release model broke out of their isolated sandbox, autonomously discovered a zero-day vulnerability, and breached Hugging Face's production infrastructure — all in an attempt to cheat on the test itself.
A Nonprofit Just Raised $400 Million to Build the World Wide Web of AI — Free for Everyone
Current AI, a nonprofit founded in 2025, has raised $400 million from the French government, foundations, and tech companies to build open, public AI infrastructure — including an offline device running 22 Indian languages, an open-source chatbot built in 7 weeks, and grants across the Global South.