What Is OpenBot? An Open-Source AI Coworker Platform

OpenBot, created on 17 August 2026 by CopilotKit, is an open-source platform built around a simple but consequential idea: give an autonomous agent not a chat window, but a machine it fully controls. Each AI coworker runs in its own isolated container with its own Chromium browser, its own persistent browser profile, its own workspace volume — and only the tools, logins, and files you explicitly grant it.

The platform was open-sourced under an MIT license and hit 1,089 GitHub stars in its first three days, 3,364 by 29 August, and roughly 5,200 by late September 2026. The latest tagged release, v0.0.13, shipped on 18 September 2026 after 406 commits. The codebase is 84.6% TypeScript and 12.3% Rust. This is alpha software under active development — the maintainers are explicit that rough edges are expected.

Unlike cloud AI products where your agent lives inside someone else’s environment, OpenBot is self-hosted. It runs on Docker Compose against your own PostgreSQL database. No model ships in the box: an administrator supplies the model credential, which is encrypted at rest and never logged. Your data and credentials stay inside your own network.

How OpenBot Gives Each Coworker a Computer of Its Own

The “each coworker gets a computer” framing is literal, not a metaphor. The architecture is one gateway server plus one container per bot. Each bot container ships its own Chromium, a workspace volume, and a persistent browser profile.

Why does the isolation matter? Because a browser profile is an identity. Most agent tools share one browser session across tasks; if that session is signed into a production account, every agent action runs with that account’s privileges. OpenBot’s per-coworker model means each bot signs into only the accounts you assign it, keeps a separate profile, and mounts only the workspace it needs. A research coworker never inherits the login of a publishing coworker.

A real browser also matters for the work itself. Modern web workflows — logging into SaaS tools, filling forms, navigating authenticated dashboards — are browser-native. An agent without a real browser has to fake the user interface; an OpenBot coworker drives the actual page.

The Policy Gateway: Every Action Decided Before It Happens, Recorded After

OpenBot’s core differentiator is what its documentation calls “every action decided before it happens and recorded after.” Every action a coworker takes — against a computer, a file, an MCP server, a UI component, a browser — routes through a single gateway.

The flow is: the gateway resolves the target, evaluates it against your CEL policy, writes an audit row, then acts — or refuses while naming the exact rule that blocked it. The computer does not decide policy. Policy lives in the gateway, and it is deny-by-default: deny rules are evaluated before allow rules; a missing policy permits nothing; a broken rule fails toward blocking.

This decide-then-record split matters because most agent tools today only do the recording. They write a log after the fact, which is precisely what OpenAI’s own postmortem described when one of its agents reached into Hugging Face production systems: the intrusion was recorded, not prevented. OpenBot’s gateway flips that — the check happens before the action has a chance to cause harm, and the refusal names the rule so a human can tune the policy with full context.

Take the Wheel: Human Handovers for 2FA, CAPTCHA and High-Risk Steps

Not everything should run unattended, and OpenBot acknowledges it. When a coworker hits a 2FA challenge, a CAPTCHA, or a high-risk step, the agent pauses and signals a human to take the wheel. The human takes over the live browser canvas directly, completes the step, then hands control back seamlessly. The handover is granular — only the affected step, not the whole task.

This matters for real-world deployments because login walls still stop agents. The take-the-wheel pattern is a pragmatic middle ground between fully autonomous (dangerous on production accounts) and fully supervised (defeats the purpose of an agent). You get automation for the routine 90% and a human exactly where the risk concentrates.

Bring Any Agent: AG-UI and Framework-Agnostic Coworkers

OpenBot is framework-agnostic because it speaks AG-UI, a standardized agent-user interface protocol. Any agent that speaks AG-UI — built with LangGraph, CrewAI, Mastra, Pydantic AI, or Google ADK — can be brought in as an OpenBot coworker with a channel of its own, with no framework binding.

This is a real advantage over platforms that lock you into one agent framework or one proprietary model. Your existing LangGraph pipeline becomes a coworker with a browser, a policy gateway, and an audit trail overnight. Add a Mastra agent tomorrow and it slots into the same gateway because the interface, not the framework, is the contract.

OpenBot also ships generative UI components: coworkers can render rich interactive React components — dashboards, forms, status panels — directly into channels, rather than dumping plain markdown.

OpenBot vs OpenAI Operator and Claude Computer Use

Two notable comparisons from the research: OpenAI’s computer-use agent, Operator, scored 38.1% on OSWorld and 58.1% on WebArena, and costs $200/month via ChatGPT Pro. OpenBot’s positioning is governance-first: open-source, self-hostable, per-bot isolated, with a policy gateway in front of every action. Cloud rivals give you capability inside their sandbox; OpenBot gives you control inside yours.

Pricing and Self-Hosting: What One Coworker Costs in RAM, Disk and Setup

OpenBot is free software — the MIT license costs nothing. The real cost is the hardware you self-host. The published resource figures for one bot (arm64, August 2026) show a wide spread between measured and documented numbers:

• Measured: 0.55 GB RAM peak, 5.3 GB disk, 0.06 vCPU
• Documented minimum: 2 GB RAM, 8 GB disk, 1 vCPU
• Recommended: 4 GB RAM, 10 GB disk, 2 vCPU

Disk is the cost people forget. Chromium launches with --disable-dev-shm-usage writing to /tmp, and the image ships Playwright’s Firefox and WebKit binaries alongside Chromium. Each coworker is its own container, so multiply the disk figure by the number of coworkers you run. Your own PostgreSQL instance adds to the footprint.

For a quick evaluation, there is a single-image quickstart: docker run with EMBEDDED_POSTGRES=on spins up an ephemeral evaluation environment without a separate database server. For production, you will want the full Docker Compose stack against a real PostgreSQL instance.

Security Considerations: OPENBOT_SINGLE_USER, Tool Grants and Prompt Injection

OpenBot’s architecture is thoughtful about policy, but it ships with a setting you should not ignore. OPENBOT_SINGLE_USER=true appears in .env.example by default, and it admits every request as one admin. The reviewers who examined it are unanimous: this is a laptop setting, not a deployment setting. On a VPS, the first person to reach the port owns the deployment, the stored credentials, and any signed-in browser. Turn it off before exposing any instance beyond localhost.

The same reviewers advise starting with an agent that has read-only access to something unimportant, and reading tool grants line by line before widening. Prompt injection is the standing threat: a coworker with a real browser and real credentials is one malicious web page away from trouble. The policy gateway is your defense — it can refuse actions that a prompt-injected agent tries to take — but only if the policy is written to catch them.

Who Should Use OpenBot in 2026

OpenBot fits a specific profile: a technical team that wants autonomous agents with real browser access, but needs the control and auditability that cloud agent products do not offer. Good candidates:

• Engineering teams that already run Docker and want self-hosted AI automation inside their network.
• Companies where data and credentials are legally or operationally required to stay in-house.
• Teams already invested in LangGraph, CrewAI, Mastra, Pydantic AI, or Google ADK that want browser-capable coworkers without a framework rewrite.
• Security-conscious operators who will invest the time to write real CEL policies and review tool grants.

Skip it if you want a plug-and-play assistant, if you cannot operate containers, or if you are not prepared to treat an alpha project like production software. Real credentials plus a real browser plus alpha code is a combination to be slow about.

Verdict: Is OpenBot Worth It?

OpenBot earns its attention not because it is flashy but because it confronts the actual blocker in agent adoption: trust. By giving each coworker an isolated computer, gating every action through a fail-closed policy before it runs, recording an audit trail after, and handing control to a human for 2FA and high-risk steps, it addresses the reasons enterprises hold back from autonomous agents.

The trade-offs are real: it is alpha software, it costs hardware and setup time, and its default single-user flag is a documented footgun. But as a governance-first, self-hostable, framework-agnostic alternative to OpenAI Operator and Claude computer use, it is the most credible open-source option on the board in 2026. If the decide-then-record model matches your risk tolerance, OpenBot is worth a Docker Compose trial on a spare machine — with OPENBOT_SINGLE_USER=false from day one.

FAQ

What is OpenBot? OpenBot is an open-source, MIT-licensed platform by CopilotKit where each AI coworker runs in its own isolated container with its own Chromium browser, logins, files, and only the tools you grant. It is self-hosted on Docker Compose with your own PostgreSQL.

Does each OpenBot AI coworker really get its own computer? Yes. The architecture is one gateway server plus one container per bot, each with its own Chromium, persistent browser profile, and workspace volume. A browser profile acts as an identity, so per-coworker isolation prevents one agent from inheriting another’s logins.

How does OpenBot enforce policy on agent actions? Every action routes through a single gateway that resolves the target, evaluates it against CEL policy, writes an audit row, and then acts or refuses while naming the rule that blocked it. Policy is deny-by-default, so a missing rule permits nothing.

How much does OpenBot cost? The software itself is free under an MIT license. You pay for self-hosted infrastructure: about 2–4 GB RAM, 5–10 GB disk, and 1–2 vCPU per coworker, plus your own model credentials — there is no bundled model.

Is OpenBot secure enough for production use? It is designed around a fail-closed policy gateway and per-coworker isolation, but it ships with OPENBOT_SINGLE_USER=true by default, which admits every request as one admin. You must disable that flag, review tool grants line by line, and treat the alpha software with caution before exposing it beyond localhost.