AI agents get their own computers and a strict chaperone

What it does

OpenBot is an agent platform that runs locally and gives every AI coworker its own isolated container, complete with a Chromium browser, file workspace, and whatever tools you grant via MCP. A central gateway sits between the agent and the outside world: it checks every planned browser click, file write, or tool call against a CEL policy, writes an audit row, and only then lets the action through—or refuses it and names the rule. You bring the agent via the AG-UI protocol, so LangGraph, Mastra, or hand-rolled endpoints all arrive the same way.

The interesting bit

The architecture treats the agent as inherently untrusted rather than conveniently capable. Each bot lives in its own computer container supervised by a gateway that resolves targets from a server-held snapshot and fails closed, meaning a broken policy or missing rule blocks the action rather than opening the gate. Even secrets are encrypted at rest and never returned by an API; the audit trail only records that a secret was used and its length, never its content.

Key highlights

• Every Bot gets its own containerized browser and workspace, optionally sandboxed with gVisor.
• All actions—browser, file, MCP, or UI component—route through a policy gateway that decides and records them before execution.
• Human-in-the-loop handoff when a Bot hits a login wall or 2FA: you take control in the same panel, and Bot actions are refused rather than queued while you drive.
• Bring-your-own-agent via the AG-UI protocol; framework-agnostic by design.
• Credentials encrypted at rest, loopback-bound computers, and an audit trail that names the rule on every refusal.

Caveats

• The project is explicitly alpha, with rough edges and active churn expected.
• It requires a CopilotKit Intelligence project and license, plus your own model API keys, so it is not a standalone free lunch.
• Out-of-the-box local development runs with authentication disabled, which is convenient but not how you would run it in production.

Verdict

Worth a look if you are building agentic workflows that need to touch real systems and you would rather explain your security posture with an audit log than an apology. Skip it if you just need a quick chatbot wrapper or are allergic to Docker Compose and external licensing dependencies.