OpenWorker is an MIT-licensed, open-source desktop AI coworker from Andrew Ng’s team that runs assigned tasks to finished deliverables on your own machine, with every action governed and logged and sandboxed execution via NVIDIA’s OpenShell.
Its bet is that the assistant category’s next step is specialist coworkers with governance built in: it ships security-review coworkers first, because attackers already have AI leverage and defenders should too.
What it is #
A desktop app (macOS Apple Silicon, signed and notarized; the official site’s Windows download is still marked coming soon while the README now links a Windows 10/11 build that is not yet code-signed) in open beta, self-updating, from the DeepLearning.AI orbit. It runs on your machine, takes a bring-your-own key for OpenAI, Anthropic, Google, or an open-weight provider, or runs fully local through Ollama, and ships specialist coworkers whose tools, working style, and check-ins come preconfigured for one job. The launch cohort is security work: codebase and dependency review where findings combine deterministic scanners (semgrep) with model reasoning and proposed fixes are re-scanned and diff-reviewed before approval, plus cloud-posture audit and incident triage. Every action an agent takes is governed and logged, approvals are configurable, and commands can run inside sandboxes: NVIDIA OpenShell on Linux and Mac, the macOS built-in sandbox with nothing to install, or a Windows hidden local account, each with its own doc in the repo.
Status #
Early and moving fast: about 18,500 stars in its first thirteen weeks as of 2026-10-17 (created 2026-07-20), with v0.3.1 released 2026-10-05, the last push on 2026-11-11 as of 2026-11-11, and a public beta disclaimer on the README.
v0.3.1 publishes the CLI as a container image on ghcr.io, so a coworker runs entirely inside an NVIDIA OpenShell sandbox with one command, and pins the desktop app’s OpenShell option to OpenShell 0.1.2. On 2026-11-07 a second distribution line opened beside the desktop releases: the skills-v0.1.0-beta.2 prerelease ships the openworker-apps app-building skill as a SKILL.md package ZIP meant for Claude’s skill-upload screen, accompanying the @openworkerai/build-with-sdk-skills package, so OpenWorker’s task recipes now distribute as plain Agent Skills too. The star count is an audience effect as much as an adoption signal: Andrew Ng’s announcement drove the attention, while the independent Hacker News footprint is one 5-point thread plus a pair of 2-point follow-ups, so the tool’s actual field usage is unproven. The project says rough edges are being polished; treat it as beta in fact, not just label.
Strengths #
- Governance is structural, not a settings page: logged actions, approval guidance, and sandboxed command execution are the default path.
- The security-coworker design enforces fixer-versus-checker separation, with deterministic scanners anchoring the model’s findings.
- No model lock-in: frontier keys or fully local through Ollama, on a machine you control.
- Task-oriented framing (finished deliverables, standing automations with full transcripts) rather than another chat window.
- Backing and velocity: an Andrew Ng team shipping weekly-quality releases into a category it also teaches.
Cautions #
- Beta software with root-adjacent powers: an agent that reads your code, cloud config, and inbox deserves more scrutiny than its ten-week age suggests.
- macOS gets signed builds while the README’s Windows build is not yet code-signed and the official site’s Windows download still says coming soon, so the cross-platform story is uneven on the security-sensitive edges.
- The coworker roster beyond security is mostly roadmap; the launch promise is narrower than the homepage’s everyday-work examples.
- Its governance vocabulary (approvals, logs, sandboxes) overlaps what your OS and IAM already enforce, and the two layers are not integrated.
- The 18k-star traction has no independent usage record behind it yet.
Pricing #
Free and open source under MIT. You pay your model provider directly, or nothing if you run Ollama locally; there is no hosted tier and no OpenWorker subscription.
Compared to #
- OpenClaw: the heavyweight personal assistant framework with channels, skills, and a huge ecosystem; choose OpenClaw for maximal capability, OpenWorker for governed, task-finished security work from day one.
- Hermes Agent: Nous Research’s autonomous agent with self-created skills and messaging gateways; OpenWorker is the desktop-first, governance-first counterpart.
- OpenShell: the NVIDIA sandbox OpenWorker builds on; use it directly if you want the isolation without the coworker.
Bottom line #
Recommended for security-minded engineers who want a governed desktop coworker for review and triage work they can run on their own keys. Not for anyone needing a mature, broadly capable assistant today, or Windows-first teams that need signed builds.
Changes #
- 2026-10-02 - Created.
- 2026-10-03 - Corrected the Hacker News footprint claim to one 5-point thread plus a pair of 2-point follow-ups (the Algolia search returned a third thread the creation run missed), and refreshed the as-of numbers (about 18,400 stars, pushed 2026-10-02, v0.3.0 still latest).
- 2026-10-06 - Recorded v0.3.1 (2026-10-05), which publishes the CLI as a ghcr.io image so a coworker runs inside an OpenShell sandbox with one command and requires OpenShell 0.1.2, with refreshed adoption numbers.
- 2026-10-07 - Added the andrewyng/openworker star history chart to the Status section.
- 2026-10-17 - Rotation re-verification: every cited URL re-fetched live, v0.3.1 confirmed still latest and the beta disclaimer intact, and the sandbox story recorded as extending beyond OpenShell (the README now documents a macOS built-in sandbox and a Windows hidden-local-account sandbox beside it, plus OpenRouter key and account sign-in paths).
- 2026-10-23 - Rotation re-verification: every cited URL re-fetched live (repo and releases APIs, the product site, the OpenShell sandbox doc, the approval-guidance doc), v0.3.1 confirmed still the latest release and the OpenShell 0.1.2 pin intact, and the Windows download recorded as marked coming soon on the official site.
- 2026-10-29 - Rotation re-verification: every cited URL re-fetched live (repo and releases APIs, the product site, the OpenShell sandbox doc, the approval-guidance doc), v0.3.1 confirmed still the latest release, the OpenShell 0.1.2 pin and the approval-guidance model intact, and the Windows download still marked coming soon on the official site.
- 2026-11-04 - Rotation re-verification: every cited URL re-fetched live (repo and releases APIs, the README, the product site, the OpenShell sandbox doc, the approval-guidance doc), v0.3.1 confirmed still the latest release, the OpenShell 0.1.2 pin and the approval-guidance model intact, and the Windows story updated: the README now links a Windows 10/11 build that is not yet code-signed (signing in progress) while the official site’s Windows download stays marked coming soon.
- 2026-11-08 - Recorded the skills-package distribution line opening beside the desktop releases (skills-v0.1.0-beta.2, published 2026-11-07: the openworker-apps app-building skill shipped as a SKILL.md package ZIP for Claude’s skill-upload screen, accompanying the @openworkerai/build-with-sdk-skills package), with v0.3.1 confirmed still the latest desktop release and refreshed adoption numbers.
See also #
- Assistant Runtimes Feature Matrix - the category comparison this note joins
- OpenClaw - the ecosystem-heavy personal assistant incumbent
- Hermes Agent - the autonomous research-agent counterpart
- OpenShell - the NVIDIA sandbox layer this runtime integrates
- The Agentic Development Environment Landscape - the tracker this section extends
References #
https://github.com/andrewyng/openworker - repository, MIT license, stars, beta disclaimer, use cases, and the governed-by-design section as of 2026-11-04
https://openworker.com/ - product positioning, download platforms, and the specialist-coworker framing