The Agentic Trust Boundary: Meet OpenBot
The software industry is rapidly moving from single-turn chat assistants to autonomous AI agents capable of browsing the web, manipulating local files, and executing shell scripts. However, deploying autonomous agents inside enterprise environments has introduced a fundamental security bottleneck: trust.
Allowing an autonomous agent to execute arbitrary bash commands or browse internal web apps using an engineer's personal browser profile presents immense operational risk. Conversely, restricting agents to read-only sandboxes renders them incapable of handling real-world developer tasks.
OpenBot is an open-source AI coworker platform developed by CopilotKit. Built on the open AG-UI protocol, OpenBot provides each AI agent with its own dedicated virtual computer, an isolated browser session, and a fail-closed governance gateway that audits and validates every single action before execution.
What is OpenBot?
OpenBot is a self-hosted agent platform designed to run within your own infrastructure (via Docker Compose and PostgreSQL). Rather than treating an agent as a transient script, OpenBot provisions each bot as an autonomous coworker with its own dedicated environment:
- Isolated Runtime: Runs in a separate container with a private
/workspace volume and an independent browser profile.
- Pre-Execution Policy Check: Every command, navigation event, and tool call passes through a central security gateway.
- Interactive Collaboration: Team members can watch agents work on a live screen, review execution activity, or intervene in real time.
Key Core Features
1. A Dedicated Computer per Coworker
Each agent operates inside an isolated Docker container (with optional gVisor runsc kernel sandboxing). Bots manage their own browser logins, download dependencies, and compile scripts in their private workspace without risking the host system.
2. Fail-Closed CEL Policy Gateway
No agent action occurs without explicit, audited authorization:
- Common Expression Language (CEL): Security policies evaluate intents, target domains, file paths, and shell arguments prior to execution.
- Audited Traceability: Every permitted action, refusal, and error is stored in a searchable audit ledger (
/admin/audit).
- Secret Redaction: Passwords and environment credentials are encrypted at rest and masked from transcripts.
3. "Take the Wheel" Human Intervention
When an agent encounters a multi-factor authentication (2FA) prompt, CAPTCHA, or high-risk decision, it pauses and requests assistance. A human operator can take over the browser canvas directly from the web interface, complete the authentication, and return control seamlessly to the agent.
4. Universal AG-UI Protocol Compatibility
OpenBot is framework-agnostic. Any endpoint adhering to the open AG-UI protocol can be registered as an autonomous coworker—whether developed using LangGraph, CrewAI, Mastra, Pydantic AI, or custom code.
5. Generative UI Components
Beyond plain markdown responses, OpenBot coworkers can render rich, interactive React components directly into user channels—enabling live dashboards, forms, and visual data inspection.
# Run locally with Docker
docker run -p 3001:3001 --env-file .env \
-e EMBEDDED_POSTGRES=on -v openbot-data:/var/lib/postgresql \
ghcr.io/copilotkit/openbot:latest
Conclusion
Autonomous agents cannot deliver enterprise value without verifiable governance and isolated execution environments. OpenBot provides the missing architectural blueprint: giving AI coworkers the tools they need to do real work, backed by the security boundaries required to trust them.
Want to deploy your own governed AI coworkers? Check out the OpenBot GitHub Repository.