OpenBot: Secure AI Coworkers with Autonomous Browsers and Tools

Introduction

OpenBot, developed by CopilotKit, is an innovative open-source project designed to provide secure and autonomous AI coworkers. Each AI agent operates within its own dedicated virtual computer, complete with a browser, file system, and a suite of tools. This unique architecture ensures that every action taken by an agent is pre-approved and fully auditable, fostering trust and control in AI-driven operations. Built on the AG-UI protocol, OpenBot offers flexibility, allowing integration of various agent frameworks.

For more details, visit the OpenBot GitHub repository.

Why Use OpenBot and Its Advantages

OpenBot stands out with several key features that make it a powerful and trustworthy platform for deploying AI agents:

A Computer Per Bot: Each AI coworker is assigned its own isolated container, browser profile, and /workspace volume, significantly enhancing security and preventing cross-contamination between tasks or agents.
Secure Gateway for Actions: All agent actions, including browser navigation, file operations, and tool calls, are routed through a central gateway. This gateway resolves targets, evaluates policies, writes an audit row, and only then executes the action, ensuring accountability and control.
CEL Policy, Fail Closed: The platform uses Common Expression Language (CEL) for policy enforcement. Operating on a "fail closed" principle, any missing or broken rule results in a refusal rather than an unintended permission, bolstering security.
Transparency and Control: Users can monitor a Bot's screen and activity in real-time, observing executed commands, read files, and saved data. The platform also allows users to "take the wheel" when a Bot encounters obstacles like login walls or 2FA prompts, with all control transfers recorded.
Bring Your Own Agent: OpenBot is framework-agnostic, supporting any AG-UI endpoint. This flexibility enables developers to integrate agents built with various frameworks such as LangGraph, Mastra, CrewAI, or custom solutions.
Component-Based Interaction: Agents can respond with compiled React components instead of just prose, enabling richer, more interactive, and structured user experiences.
Governed MCP (Multi-Cloud Platform): Integrates with services like Google Drive and Notion, offering a curated catalogue and strict policy enforcement for tool usage, ensuring agents interact with external services securely.
Encrypted Credentials and Audit Trail: Credentials are encrypted at rest and never exposed in transcripts or API responses. A comprehensive, human-readable audit trail logs all permitted, refused, and failed actions, providing clear visibility into agent behavior.
Loopback Security: Bot computers bind to 127.0.0.1 and require per-container tokens, preventing unauthorized external access to logged-in browser sessions and enhancing overall system security.

Installation

To get started with OpenBot, follow these quick steps. Ensure you have Docker, Bun 1.3+, a CopilotKit Intelligence project, and a model key (e.g., OpenAI API key) ready.

Create your .env file:

cp .env.example .env

Get CopilotKit Intelligence credentials and set INTELLIGENCE_API_KEY in .env:

npx --yes copilotkit@latest login
npx --yes copilotkit@latest project select

Fill the remaining required values in .env, such as OPENAI_API_KEY, and generate a strong KEY_ENCRYPTION_KEY (e.g., openssl rand -base64 32).
Install dependencies and run the services:

bun install
bash scripts/start.sh

Open your browser to http://localhost:3010 to access the OpenBot UI.

Examples

Once OpenBot is running, you can try out these interactions:

Open /bot and ask: Open news.ycombinator.com and tell me the top story.
Ask the Bot to fill out https://httpbin.org/forms/post, then inspect /admin/audit.
Open /admin/boundaries, add a deny rule or preset, and retry the same browser action.
Create a coworker from /agents, give it a standing role, and start a channel with it.