Andrew Ng released OpenWorker on July 23, an MIT licensed desktop agent now in open beta whose framing is a small but real departure. You do not write it a prompt, you give it an outcome: a polished document, a reply that contains the actual numbers, an updated calendar, a triaged inbox. It breaks the outcome into steps, works across local files and connected applications, and checks in before doing anything consequential. Ng calls it a coworker rather than a chatbot, and the product is built to make that more than a slogan.
It is local first in the strict sense. The agent loop, the conversations, the connector tokens and the model API keys all live on the user's machine. The stack is a Tauri 2 and React 18 desktop shell over a Python FastAPI server bound to 127.0.0.1:8765, with turns capped at 12 iterations. A provider agnostic model router built on aisuite offers around 30 curated models that you drive with your own API keys, or fully local models through Ollama. Roughly 25 connectors ship with it, including GitHub, Slack, Jira, Notion, Linear and HubSpot, alongside terminal and local file access.
The part worth studying is the permission model. Every tool call is classified into one of four risk classes before it executes: read, which has no side effects, write_local, which mutates the workspace and is scoped to a path, exec, which runs commands, and external, which has effects off the machine. Five modes sit on top of that. Discuss and plan are read only, interactive is the default and confirms before writes and external calls, auto permits anything inside the path boundary, and custom auto approves a user defined whitelist. Shell commands always require approval regardless of mode.
The best decision in the design is what unattended mode does not do. It does not raise the agent's autonomy. It routes approvals to an inbox and suspends the session until a human answers. Most desktop agents treat unattended as a synonym for trusted, which quietly converts nobody is watching into you may do more. Keeping those two ideas apart is most of the difference between an agent you can leave running and one you should not.
That is what makes this more than another entry in a crowded category. Desktop agents have been shipping all year with safety stories that amount to a confirmation dialog bolted onto the interface. Typing risk at the tool layer, before the call runs, is structural rather than cosmetic, and an MIT licence means the pattern can be read and copied rather than admired from outside. Coming from someone whose reach has always been through teaching, that is probably the point.