// the take
OpenWorker is Andrew Ng's desktop AI agent that goes beyond chat to produce finished deliverables — reviewed code, documents, triaged inboxes — by running tool calls against your files, terminal, and connected apps (Slack, GitHub, Jira, etc.). It's for developers and technical teams who want an approval-gated agent runner on their own machine with their own model key, not a hosted SaaS copilot.
The governance model is actually layered, not just a single confirm-before-running toggle: hard floors that no auto-approve setting can bypass, a graduated allowlist system, and a persisted audit trail with approval provenance per tool call. Sandbox isolation is real infrastructure work — a per-session Linux container via NVIDIA OpenShell on Linux, the built-in macOS sandbox, or a hidden Windows account — rather than a vague 'runs safely' claim. Provider support is broad and genuinely pluggable (OpenAI, Anthropic, Gemini, DeepSeek, Qwen, local Ollama, etc.) via aisuite, so you're not locked into one vendor's pricing or rate limits.
It's beta software distributed as signed/notarized binaries for macOS but unsigned on Windows, so Windows users eat a SmartScreen warning out of the gate. Running from source needs Python, Node, and the Rust toolchain simultaneously (for the Tauri shell), which is a heavier bar than most CLI agent tools. The 'local-first, your data only leaves through the model you choose' pitch has an asterisk — a cloud service brokers OAuth for every connector, so there's a vendor-run component in the critical path regardless of which model you pick. The auto-approve mode leans on a reviewer model to gate risky actions, and the docs are upfront that 'reviewer verdicts are judgments, not guarantees' — that's an honest admission, but it means the safety story under auto-approve is probabilistic, not deterministic like the hard floors.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →