CopilotKit's OpenBot gives every agent its own computer and checks each action

CopilotKit published OpenBot, an open-source platform where each agent gets its own environment: a browser with its own logins, its own files, and only the tools it has been granted. The repository was created on 17 August 2026 and had 3,598 stars and 449 forks on 31 August, under an MIT licence.

The README labels it alpha and under active development, and says to expect problems.

How it is put together

Docker Compose starts every part. Data is stored in your own PostgreSQL. No model is included: an administrator supplies the credentials, so the choice of model is yours.

It takes any AG-UI agent, written on a framework or by hand, and gives it a place to work alongside people. You can watch the agent work on its own screen, take over when it reaches something it should not do alone, and hand control back. Agents answer with interface components rather than only text.

A fresh clone sets OPENBOT_SINGLE_USER=true in .env.example, which accepts every request as one administrator so the product works before you configure an OAuth client. That is convenient and it is also a security gap. Turn it off before anyone else can reach the deployment, which is what the project's own sign-in section says.

The sentence to pay attention to

"Every action decided before it happens and recorded after."

That is two separate mechanisms and both matter. Deciding before is a policy check that runs ahead of the action. Recording after is an audit trail. Most agent tooling today only does the second one, which means you find out what happened by reading the log afterwards.

Where the risk actually is

"A real browser with its own logins" is the phrase to read carefully. An agent with a logged-in browser can do anything the account can do. The controls around that are what stop a task from becoming a security incident.

Running on your own infrastructure helps, because the credentials never leave your network and you can see the traffic. It does not remove the question of which logins any given agent gets.

If you try this, start with an agent that has read-only access to something unimportant, and read the tool grants line by line before expanding them. Alpha software plus real credentials is the combination to be careful with.

The architecture is worth reading regardless. One machine per agent, explicit grants, decide-then-record is a sound design, and it is easier to evaluate as running code than as a diagram.

Source

• CopilotKit/OpenBot on GitHub, MIT licence. Star, fork and date figures read from the GitHub API on 31 August 2026