Andrew Ng Updates Open Source Desktop Proxy OpenWorker
Andrew Ng announced the release of a new version of the open-source desktop proxy OpenWorker, which introduces a security "collaborator" aimed at developers and defenders, covering code vulnerabilities, dependency supply chain, and cloud configuration risk checks.
OpenWorker is not just a chat tool, but a proxy framework that runs locally on users' computers: it can access local files, terminals, and authorized external applications, breaking down tasks to generate reports, repair suggestions, code branches, or pending approval actions. The project is currently in public testing.
The new Security Reviewer can call Semgrep and key scanners, filtering results based on whether vulnerabilities are actually reachable rather than just severity, and creating pending Pull Requests for fixes that conform to codebase style; the product promises not to print keys in plaintext in conversation logs.
Dependency Audit scans dependencies and lock files, identifying vulnerable packages and prioritizing actionable risks, proposing the minimum security upgrades that meet repair conditions; it requires user approval before modifying lock files and will not merge changes if tests fail.
Cloud Posture checks Terraform and AWS real configurations in a read-only manner, generating Terraform repair plans and attaching evidence commands after discovering attack surfaces such as public buckets and overly broad IAM permissions; this collaborator does not write directly to the cloud environment and will not execute terraform apply.
OpenWorker sets key external actions as approval thresholds: before sending emails, posting Slack messages, opening GitHub Pull Requests, executing shell commands, and modifying calendars, the proxy must request confirmation. The project supports users bringing their own API keys for models from OpenAI, Anthropic, Google, etc., as well as open-weight models like DeepSeek, Kimi, Qwen, Mistral, and can run completely locally via Ollama.
Its open-source "harness" includes proxy loops, tool calls, connectors, key storage, and permission control layers. OpenWorker claims that conversations, connector tokens, and model keys are stored in the local key vault on the machine; the only optional cloud component is used to host part of the OAuth connection process, with tokens directly handed to user devices without being stored in the cloud. The code is licensed under the MIT License, and the GitHub repository currently has about 4,700 stars and 618 forks.
In terms of market mechanisms, security teams and development teams can delegate repetitive tasks such as initial vulnerability screening, dependency auditing, and cloud configuration reviews to local or chosen models, shifting expenses from manual code reviews and independent SaaS scans to model APIs, endpoint management, open-source proxy integration, and security validation. Beneficiaries include proxy infrastructure providers with local deployment, tool invocation, auditable logs, and approval control capabilities; closed security proxies that cannot explain data flows, permission boundaries, and action logs face higher procurement resistance when handling sensitive code.
Source: Public Information
ABAB AI Insight
OpenWorker clearly separates "models" from "proxy harnesses," directly addressing enterprise security concerns. Large models are responsible for reasoning and generation, while the harness determines what files the model can access, which tools it can call, how keys are stored, when to request human confirmation, and whether it can write to external systems. Andrew Ng emphasizes that the harness is fully open-source, aiming to allow security teams to audit whether data is being leaked, whether permissions are too broad, and whether approvals can be bypassed; this is closer to the real attack surface for enterprises than merely reviewing the privacy commitments of model vendors.
In terms of capital pathways, OpenWorker adopts a structure of "free open-source client + user-provided model costs": the software itself does not charge users platform fees, and users pay API call fees directly to model vendors or run models locally via Ollama. Its commercial value does not primarily come from the price difference in model inference, but from the proxy layer becoming a unified entry point for local tools, OAuth connectors, MCP services, task automation, and approval flows; once teams bind their daily workflows to this entry point, models can be replaced, but connections and operational habits are harder to migrate.
A historical comparison is GitHub Copilot's transition from code completion to proxy-style coding, as well as the evolution of LangChain, AutoGen, and the MCP ecosystem from model invocation to tool execution. OpenWorker's difference lies in its desktop-centric approach, integrating local files, terminals, and over 25 connectors into the same proxy, and explicitly requiring "complete the task first, then deliver the results." The proactive security features also align with the Shift Left model: moving vulnerabilities, dependencies, and infrastructure issues forward to the development stage, reducing the time and cost of fixing issues post-deployment.
This represents a reconstruction of the industry chain. Traditional security tools allocate scanning, work orders, code fixes, testing, and infrastructure changes to different vendors and teams; the proxy harness attempts to string them together into a closed loop of "discovery - assess reachability - generate minimum fix - human approval - submit PR." The mechanism of change is that models themselves are becoming increasingly replaceable, while auditable permissions, tool connections, approval records, and local data boundaries are harder to replicate; thus, the pricing power in security procurement shifts from "which model is smarter" to "which execution layer is more controllable."
ABAB News · Cognitive Laws
The model determines the answer, the execution layer determines the accident radius
The value of security proxies is not in fixing, but in being auditable
Open source reduces trust costs, and permission control determines commercial boundaries