Andrew Ng has announced a new release of OpenWorker, his open-source desktop agent, built around a batch of security-focused features. His stated reasoning: after the first version shipped, plenty of users found it unusually well-suited to cybersecurity work, and if attackers are already using AI, defenders deserve the same leverage.
OpenWorker skips the chat-box model entirely. Hand it a task, and it breaks the work into steps on its own, operating across files, the terminal, and connected apps, then hands back something ready to use. The project open-sourced in July under the MIT license, is currently in open beta, and has already picked up 16,400 stars on GitHub. The desktop app supports macOS 12 and later (Apple Silicon, signed and notarized) and the x64 build of Windows 10/11, with code signing for the Windows build still pending.
Scanning the Code, and Everything It Depends On
The dedicated role given top billing in the new release is called "security review." According to the repo's documentation, it does two things: it combines deterministic scanners with model reasoning to sweep both the codebase and its dependencies for real risk. The dependency side is aimed at supply-chain injection, malicious code smuggled into third-party packages, a category of incident that has shown up repeatedly across the open-source ecosystem over the past year, and one that's essentially impossible for a human to catch by manually auditing every dependency tree.
The rule around fixes goes a step further. The documentation states that any fix an agent proposes has to be rescanned and pass diff review before it's approved, and the agent that produced the fix is never the sole checker of it.
That constraint targets a specific failure mode: AI grading its own homework. When the same model both writes a patch and judges it, the output looks complete but is really just self-endorsement, since the model is just as blind to what it missed the first time around. Keeping deterministic tools like scanners in the loop adds an unforgiving check that model judgment alone can't provide.
Four Permission Tiers, Autonomy Earned Over Time
Every tool call gets sorted into one of four risk categories: read, write_local, exec, and external. Layered on top of that are five permission modes: discuss and plan are read-only; interactive is the default, asking before any write action; auto clears everything within a defined scope of paths; and custom lets you set specific, trusted tools to auto-approve.
The governance rules are hard-coded into three layers:
- Hard limits: dangerous, irreversible actions are always reserved for a human, no matter which mode is active.
- Progressive autonomy: every action requires approval by default; a one-time approval can be upgraded to a standing rule, and only above that does it graduate into the configured allowlist.
- Audit trail: every tool call logs where its approval came from, whether auto-approved, user-approved, or denied.
There's also an unattended-run rule: no self-approval. If the agent is running overnight and hits an action with real consequences, an unanswered prompt goes into an inbox to wait for review; permissions don't loosen automatically just because no one's around.
Bringing Big Tech's Tooling Down to a Laptop
Over the past year, headlines about AI finding vulnerabilities have mostly belonged to closed-source giants: one uncovering a bug more than two decades old, another flagging tens of thousands of high-severity issues in a single month, all running each company's strongest model through an enterprise sales channel, with pricing and access gated accordingly. OpenWorker takes a different route, running locally, open source, MIT-licensed, and with code that can be audited.
For security teams, the fact that the shell itself can be audited matters just as much as its scanning ability. An agent that can read an entire codebase, execute commands, and make outbound requests is by nature an ideal exfiltration channel; if it's a black box, then the more vulnerabilities it finds, the harder it becomes to assess the risk of giving it access in the first place. Here, open source functions less as a stance and more as a precondition for adoption.
Two things are still missing from the public record: the repo doesn't list a specific version number for the new release, and there's no third-party figure yet for how the scanning capability performs on public benchmarks. Before wiring this into CI, running a few rounds in an isolated environment first is the safer bet.
Sources: OpenWorker's official repository documentation, CocoLoop, MarkTechPost, Help Net Security; details on permission tiers, the three-layer governance model, and the security-review role were checked line by line against the repo's own documentation.