OpenWorker is a desktop AI coworker for macOS and Windows that returns finished deliverables rather than chat: a security review with fixes ready to apply, a document or spreadsheet, a Slack reply with the numbers, or a triaged inbox. You describe the outcome, OpenWorker breaks it into steps and works across the desktop, local files, terminal, and connected apps, and it checks in before anything consequential such as sending a message, changing a calendar, or running a command. It is in open beta.
Specialist coworkers arrive with the tools, working style, and check-ins for one job already set up, and the Security coworkers ship first. They cover code and dependency security review (findings from deterministic scanners such as semgrep plus model reasoning, with proposed fixes re-scanned and diff-reviewed before approval), cloud configuration audits, and incident triage.
Governance is part of the architecture. Dangerous and irreversible operations are always human-only, actions are approval-gated by default and can graduate into standing rules and allowlists, and an optional auto-approve mode uses a reviewer model that escalates anything uncertain and pauses after repeated denials. Every tool call is recorded with its approval provenance, and unattended runs park their requests in an inbox until a person answers. Commands and file tools can run inside an NVIDIA OpenShell container, the built-in macOS sandbox, or a hidden local Windows account.
OpenWorker is local-first: the agent loop, conversations, connector tokens, and model keys stay on the machine, and the only cloud piece is a small service that brokers OAuth handshakes for connectors. The engine is a local Python agent server built on Aisuite, with a React and Tauri desktop shell.
Features
- Finished deliverables: documents, spreadsheets, reports, and web pages land as files you can open and share
- Security coworkers: code and dependency review, cloud posture audits, and incident triage
- Slack sessions: mentioning OpenWorker in a channel opens a desktop session and returns the answer as a thread reply
- Connectors: 25+ integrations including GitHub, Slack, Jira, Notion, Linear, HubSpot, Outlook, monday.com, Gmail, and Google Calendar, plus any MCP tool with per-tool control
- Scheduled automations: recurring work such as a morning brief or weekly report, with full transcripts
- Approval gates: writes, sends, and shell commands need approval, with an optional auto-approve mode backed by a reviewer model
- Audit trail: every tool call is stored with whether it was auto-approved, user-approved, or denied, and the reviewer's reasoning
- Sandboxed commands: per-agent Linux containers through NVIDIA OpenShell with an allow-listed network, or the native macOS and Windows sandboxes
- Model choice: bring your own key for hosted providers, use open-weight models through Together and Fireworks, or run fully local with Ollama
