Andrew Ng 发布 OpenWorker：开源本地优先桌面 AI 智能体，直接交付成品而非对话

Andrew Ng 宣布了 OpenWorker：https://x.com/AndrewYNg/status/2080333504446108104，这是一个开源桌面代理，生成的是完成的工作而不是对话。OpenWorker 向用户询问的是结果，而不是提示：一个完善的文档、一条包含实际数字的 Slack 回复、一份更新的日历、一封经过分类的邮箱。然后它将该结果分解为步骤，跨本地文件和连接的应用程序工作，并在执行任何重要操作前进行确认。

该仓库包含 119 个位于 coworker/ 下的 Python 文件（约 32,400 行），149 个位于 surfaces/gui/ 下的 TypeScript/TSX 文件，以及 78 个后端测试模块。

该引擎基于 aisuite：https://github.com/andrewyng/aisuite，这是 Andrew Ng 的提供者无关的 LLM 库。

没有 OpenWorker 推理服务。用户可以粘贴 API 密钥，或将应用指向本地运行时。

策划的模型矩阵恰好包含 30 个条目。本地提供者覆盖 OpenAI（GPT-5.6 Sol/Terra/Luna 和 GPT-5.5）、Anthropic（Claude Fable 5, Opus 4.8, Sonnet 4.6, Haiku 4.5）和 Google（Gemini 3.1 Pro, 3.6 Flash, 2.5 Pro, 2.5 Flash）。兼容 OpenAI 的供应商增加了 GLM-5.2、DeepSeek V4、Kimi K2.6、MiniMax M2.5、Qwen3 Max、Grok 4.3 和 Mistral Large。基于 Together AI：https://www.together.ai/ 和 Fireworks：https://fireworks.ai/ 获得开权重模型，通过 Ollama：https://ollama.com/ 获得完全本地模型，无需任何密钥。

大多数桌面代理项目将审批视为 UI 的附加功能。OpenWorker 将其视为一个类型化层。

每次工具调用都会被分类为四种风险类型之一：read（无副作用）、write_local（修改工作空间，路径范围内）、exec（运行命令）和 external（对机器外部产生副作用）。然后五种权限模式决定将发生什么：discuss 和 plan 为只读，interactive 为默认模式并在写入、命令和外部操作前请求确认，auto 允许一切操作但仍限于路径范围内，custom 自动批准用户列出的工具集合。

内置的 ops 角色还指示模型将工具、日志、网页、文件和传入消息的内容视为不可信数据而非指令。这是一种明确的提示注入防护姿态，写入了随附角色中。

模型调用直接从机器发送到配置的提供者。对话、连接器令牌和模型密钥保持本地，秘密存储设计确保秘密从未进入模型的上下文、提示或跟踪中。

唯一的云组件是处理一键连接器 OAuth 握手的可选代理，使用 Auth0 带 PKCE 的授权码。连接器令牌直接交给机器，绝不存储在云端。应用程序在未登录状态下也能完全运行，通过手动粘贴的凭据使用。

查看 GitHub 仓库：https://github.com/andrewyng/openworker，项目网站：https://openworker.com/，以及公告：https://x.com/AndrewYNg/status/2080333504446108104。所有研究成果归功于该项目的研究人员和开发人员。

Asif Razzaq 是 Marktechpost Media Inc. 的首席执行官。作为具有远见的企业家和工程师，Asif 致力于利用人工智能的潜力推动社会公益。他最近的努力是推出人工智能媒体平台 Marktechpost，该平台以对机器学习和深度学习新闻的深入报道而著称，内容既技术可靠又易于广大受众理解。该平台每月浏览量超过 200 万，显示出其在受众中的受欢迎程度。

Andrew Ng has announced OpenWorker：https://x.com/AndrewYNg/status/2080333504446108104, an open-source desktop agent that produces finished work rather than conversation. OpenWorker asks the user for an outcome , not a prompt: a polished document, a Slack reply containing the actual numbers, an updated calendar, a triaged inbox. It then breaks that outcome into steps, works across local files and connected apps, and checks in before anything consequential.

The repository contains 119 Python files (~32,400 lines) under coworker/ , 149 TypeScript/TSX files under surfaces/gui/ , and 78 backend test modules.

The engine is built on aisuite：https://github.com/andrewyng/aisuite, Andrew Ng’s provider-agnostic LLM library.

There is no OpenWorker inference service. The user pastes an API key, or points the app at a local runtime.

The curated model matrix contains exactly 30 entries. Native providers cover OpenAI (GPT-5.6 Sol/Terra/Luna and GPT-5.5), Anthropic (Claude Fable 5, Opus 4.8, Sonnet 4.6, Haiku 4.5) and Google (Gemini 3.1 Pro, 3.6 Flash, 2.5 Pro, 2.5 Flash). OpenAI-compatible vendors add GLM-5.2, DeepSeek V4, Kimi K2.6, MiniMax M2.5, Qwen3 Max, Grok 4.3 and Mistral Large. Open-weight models arrive through Together AI：https://www.together.ai/ and Fireworks：https://fireworks.ai/, and fully local models through Ollama：https://ollama.com/, which requires no key at all.

Most desktop agent projects treat approvals as a UI afterthought. OpenWorker treats them as a typed layer.

Every tool call is classified into one of four risk classes: read (no side effects), write_local (mutates the workspace, path-scoped), exec (runs commands), and external (side effects off the machine). Five permission modes then decide what happens: discuss and plan are read-only, interactive is the default and asks before writes, commands and external actions, auto allows everything while remaining path-scoped, and custom auto-approves a user-listed set of tools.

The built-in ops persona also instructs the model to treat content from tools, logs, the web, files and incoming messages as untrusted data rather than instructions. That is an explicit prompt-injection posture, written into the shipped persona.

Model calls go directly from the machine to the configured provider. Conversations, connector tokens and model keys stay local, and the secret store is designed so that secrets never enter the model’s context, prompts or traces.

The only cloud component is an optional broker that handles OAuth handshakes for one-click connectors, using Auth0 Authorization Code with PKCE. Connector tokens are handed straight to the machine and are never stored in the cloud. The app is fully functional signed out, using manually pasted credentials.

Check out the GitHub Repo：https://github.com/andrewyng/openworker, the project site：https://openworker.com/, and the announcement：https://x.com/AndrewYNg/status/2080333504446108104. All credit for this research goes to the researchers and developers of this project.

Asif Razzaq is the CEO of Marktechpost Media Inc.. As a visionary entrepreneur and engineer, Asif is committed to harnessing the potential of Artificial Intelligence for social good. His most recent endeavor is the launch of an Artificial Intelligence Media Platform, Marktechpost, which stands out for its in-depth coverage of machine learning and deep learning news that is both technically sound and easily understandable by a wide audience. The platform boasts of over 2 million monthly views, illustrating its popularity among audiences.