OpenWorker did not build a vulnerability scanner. It wrote down what an agent must do when the scanner is missing.
That distinction is the most consequential part of the project's August 24 v0.2.0 release. Andrew Ng and Rohit Prasad's open-source desktop agent now ships a Security Coworker for application code, a Dependency Audit Coworker for the software supply chain, and a Cloud Posture Coworker for infrastructure and AWS configuration. Each appears in the product as a specialist agent. In the repository, each is a Markdown manifest plus a small set of reusable skills.
The first reading is easy: attackers have AI, so defenders need AI scanners too. The source supports a narrower and more useful story. OpenWorker's security-bundle commit says the coworkers drive existing open-source scanners. Detection stays with Semgrep, Gitleaks, OSV Scanner, npm audit, pip-audit, Trivy, Checkov, and cloud command-line tools. The model is assigned the work around those engines: decide whether a finding is reachable, rank the actual exposure, make the smallest safe repair, add the test, and prepare a focused pull request.
Three coworkers, three authority lines
The Security Coworker starts with Semgrep for static analysis and Gitleaks for secrets. Its instructions say a scanner result is not a verdict: read the flagged code, ask whether input is attacker-controlled, inspect upstream guards, and label each hit critical, high, medium, low, or noise with a reason. A real fix must follow the codebase's own patterns and carry a test. A discovered secret is never to be printed; rotation comes before history cleanup.
The unusual rule is what happens when a tool is absent. The coworker must request it, perform a disclosed manual fallback, or report the check as not run. It cannot silently drop the lane. Every review ends with a coverage note naming what actually ran. That is modest language with large operational value: in security work, “we could not look” must not be rendered as “nothing was there.”
The Dependency Audit Coworker makes a different judgment explicit. CVSS severity is not the same as local priority. Its skill asks whether a vulnerable function is reachable, whether the package is direct or transitive, and whether the smallest patch or minor release closes the advisory. It then regenerates lockfiles with the project's own package manager and requires install, build, and test receipts before proposing the upgrade. The agent is not supposed to turn “upgrade everything” into a security plan.
The Cloud Posture Coworker draws the hardest boundary. Trivy or Checkov scans infrastructure as code. Live AWS inspection is limited in the written procedure to describe, list, get, and simulate calls. The coworker may prepare Terraform and a plan, but it may not run terraform apply or repair the account by clicking around a console. The intended consequence is durable: fix the configuration at its source instead of creating drift.
The open artifact is the procedure
OpenWorker's release makes those operating choices inspectable because they live in the harness repository. The bundle contract tests check that all three coworkers are enabled, that each receives only its own skills, and that their prompts retain specific guardrails. The tests pin language such as “never silently skip,” require coverage reporting, preserve the secret-handling ban, and ensure the cloud bundle says “read-only.” A packaging rule includes the manifests and their SKILL.md files in the application.
This is not merely transparency theater. A security lead can inspect which tools the agent expects, which missing-tool behavior it follows, which cloud verbs the procedure permits, and how a finding is supposed to become a reviewed change. The instructions are versioned beside the runtime instead of hiding inside a hosted system prompt.
But the tests reveal the limit as clearly as the value. They prove that the words ship. They do not prove that every supported model follows them, that a community ruleset finds the right issue, or that the model judges reachability correctly. OpenWorker's runtime can put generic shell execution behind an approval gate. The skill's narrower bans—never mutate the cloud, never apply Terraform—are instruction contracts layered on top of that gate, not evidence that an AWS policy or operating-system sandbox makes those actions impossible.
Local moves one boundary, not all of them
Model choice still matters. OpenWorker's public architecture keeps the agent loop, conversation, keys, and connector tokens on the user's machine, and it can route inference to Ollama so source code does not have to cross a model provider's boundary. A team may also choose a cloud model, including the frontier models the security manifests recommend. The project states the privacy bargain accurately: data leaves through the model and integrations the user chooses.
A fully local model therefore removes one disclosure path. It does not make a GitHub pull request local. It does not make AWS posture local, or fetch a scanner without a network, or validate the provenance of a downloaded ruleset. It also does not make a weaker model's triage reliable. Open source lets a team audit this harness and build it themselves; it does not substitute for auditing dependencies, release binaries, configuration, or the model-harness pair they actually run.
That is why OpenWorker's “shift left” contribution is best understood as procedure. The release moves scanner coverage, contextual triage, authority checks, minimal repairs, and test evidence closer to the developer's machine before deployment. Its next convincing artifact should be an equally open evaluation: seed the same repositories with known code, dependency, and cloud-configuration faults; run local and cloud models under each permission mode; remove one scanner on purpose; and publish missed findings, false positives, coverage disclosures, approved effects, and fix quality.
If that record shows the coworkers saying “not checked” when they could not check, stopping at the promised authority line, and delivering small fixes that survive review, OpenWorker will have proved something more durable than an AI security demo. It will have shown that an open harness can make security work auditable before the model ever gets credit for it.