OpenBot is an open-source AI coworker you run yourself — and it asks before it acts.

What it is

OpenBot is an open-source platform for running AI "coworkers": bots you hand real work to, that use a browser, read and write files, and call tools. It comes from CopilotKit, the company behind the AG-UI protocol for connecting agents to apps, and it is released under the MIT licence. Despite the name, it has nothing to do with Microsoft's Copilot.

It is a template, not a service. "There is no hosted version to sign up for," the README says — you clone it and run it on your own infrastructure. CopilotKit's product page puts it as "a fully customizable agent application for your employees, running on infrastructure you own."

It is the same idea as xAI's Grok Bot and the other commercial AI coworkers launched this year, but with the code, the data and the rules on your side.

A computer for every bot

The core design choice is isolation. "Each coworker gets a real browser with its own logins, its own files, and only the tools you grant," the README says. By default each person gets one container, with a separate folder and browser profile per bot; a bot can be marked "Isolated" to get a container of its own, and those containers can run under gVisor, a sandbox that adds a second wall between the bot and the host.

A small supervisor process is the only thing allowed to create these computers, and, per the project's diagram, no bot can read another's files or reuse another's sign-ins.

Decide first, record after

The more interesting part is what sits between the bot and that computer. "Anything a Bot does to a computer, a file, an MCP server or a component goes through one gateway that decides and records it," the README says. "There is no path that acts without the record existing first."

How a bot's action reaches its computerCopilotKit · MIT

That gateway works in four steps: it resolves what the bot is trying to touch, decides against a policy, writes an audit row, and only then acts — or refuses and names the rule that stopped it. The policies fail closed: "Deny is evaluated before allow, a missing policy permits nothing." Since v0.0.5, a new rule can be tested against past activity before it is saved.

The same care applies to secrets. Credentials are encrypted at rest, never returned by an API, and redacted from audit events; the README says "Secrets never enter the transcript."

Taking the wheel

When a bot hits something it should not handle alone — a login, a two-factor prompt — it stops and asks. A person can watch the bot's browser live and "take the wheel." While they do, the bot is locked out: "While a person is driving, Bot actions are refused rather than queued." Each handover is logged like any other action.

"OpenBot turns agents from clever assistants into coworkers you can actually trust with real work." — Eli Berman, CopilotKit

Bring your own agent

OpenBot does not ship a model or a single agent. "A Bot is any endpoint speaking AG-UI," the README says, and the repository includes example bots for LangGraph, CrewAI, Mastra, Pydantic AI, Google's ADK, the Claude Agent SDK, Microsoft's agent framework and others. You supply the model key — the bundled LangGraph bot can use OpenAI, Anthropic or Google.

The v0.0.5 release at the end of August added connectors for Google Drive (read-only) and Notion, bots that can hand work to each other — off by default until an administrator allows it — scheduled routines, and sign-in through Google, Microsoft, Okta, SAML or OIDC. A Helm chart targets Amazon, Google and Microsoft's Kubernetes services.

How fast it is moving

The first release was tagged on August 17. The latest, v0.2.0, landed on October 12 — the nineteenth in under two months. The repository shows about 9,100 stars, up from the 3,500 CopilotKit celebrated on September 1.

The pace shows in the release notes, including the uncomfortable parts. v0.0.5 fixed how tokens for MCP servers were bound, and told affected deployments to "treat the credentials involved as disclosed and rotate them." v0.1.1 was largely security fixes. That is what early, actively developed software looks like — and a reason to read the notes before every upgrade.

Before you run it

• It is beta. "OpenBot is early. Expect rough edges and bugs," the README says.
• One dependency is not optional. Conversation threads and memory live in CopilotKit Intelligence. There is a free plan, and Intelligence can be self-hosted, but OpenBot needs it either way.
• The demo setup is wide open. The example configuration admits every request as a single administrator. Set up sign-in before anyone else can reach it.
• Production means Kubernetes. "Docker Compose stands up a demo; Helm is the supported path to production."