Is OpenWorker the Safe Version of OpenClaw?

Yes, and the permission engine is the difference

OpenWorker is Andrew Ng's open-source desktop agent, MIT-licensed, announced July 23, 2026.¹ The pitch is the same one OpenClaw made: an AI that touches your files, your terminal, and your work apps, and hands back finished work. The difference is that OpenWorker sorts every tool call into a risk class before it runs one. OpenClaw was the cautionary tale, with Bitsight counting over 30,000 exposed instances online in a two-week window.²

What it actually does

You ask for an outcome, not an answer, which is the same instruction shape that works on human teams. It splits the task into steps, works across your files and 25 plus connectors including GitHub, Slack, Jira, Notion, HubSpot, Gmail, and Google Calendar, then leaves a file you can open.³ React and Tauri on top, a Python agent server underneath, built on Ng's aisuite library.

Four risk classes, five modes

In the source, every tool is classified read, write_local, exec, or external. Reads always run. Everything else meets a permission engine with five modes: discuss and plan are read-only, interactive asks before writes and commands, custom auto-approves a named list, auto allows everything. MCP servers default to requiring approval, and writes must resolve inside a folder you marked writable, so a relative path cannot climb out.

The allowlist detail that gives it away

You can allowlist shell commands to skip approval. The code first rejects any command containing ;, &&, |, >, a backtick, or $(, then matches parsed arguments rather than raw text. The comment says why: naive prefix matching means git status would auto-approve git status && rm -rf ~. Someone sat down and asked how their own convenience feature gets abused. That is not vibe coding.

It credits OpenClaw in its own source

Line three of coworker/secrets.py reads: "Design (from OpenClaw): secrets never enter the model's context, prompts, or traces." It is the only mention of OpenClaw in the repository. One idea taken, credited in a code comment nobody was supposed to read, and the rest of the security posture rebuilt from scratch. That is the honest version of what happened here.

Where it is still beta

The same file calls the store "a 0600 JSON file" with a Keychain backend planned later, so connector tokens sit in plaintext that anything running as your user can read. Windows builds are not code-signed. Auto mode really is full access on shell. Judge it the way you would any agent you hand a real machine to: read the modes, then pick one.

References