Open-Source AI Coworkers with Isolated Browsers: Inside CopilotKit 'OpenBot'

As autonomous AI agents evolve from conversational text interfaces into operational systems capable of driving web browsers and interacting with computer file systems, establishing secure, isolated working environments has become a critical engineering challenge. In response, CopilotKit has released 'OpenBot', an MIT-licensed open-source AI coworker platform that equips each autonomous agent with its own dedicated browser session, sandboxed file system, and real-time human-in-the-loop intervention controls.

Image source: CopilotKit / @RoundtableSpace via X

While standard chatbot integrations operate within shared, stateless contexts, real-world delegation demands dedicated login sessions, strictly partitioned storage, and immediate administrative oversight. OpenBot addresses this by deploying on a self-hosted Docker Compose stack with local PostgreSQL storage, allowing teams to run specialized coworkers without cloud lock-in, while bridging agent workflows into interactive interfaces via the AG-UI protocol.

Dedicated Browser Sessions and Sandboxed File Systems per Agent

The defining technical architecture of OpenBot centers on giving each agent an entirely isolated computing workspace rather than a shared runtime.

In conventional multi-agent setups, concurrent agents frequently share a single system context or browser instance, leading to credential cross-contamination, session overwrites, and unconstrained file access risks. Released under the permissive MIT license, OpenBot fundamentally mitigates these vulnerabilities by sandboxing each coworker:

• Isolated Browser Sessions: Each agent operates within its own dedicated browser instance, maintaining separate authentication cookies, state, and login sessions. When an agent logs into a SaaS portal or interacts with an internal web console, its session remains completely segregated from host processes and other coworkers.
• Sandboxed File Systems: Agents receive dedicated virtual directory structures. Document generation, file manipulation, and script outputs are constrained strictly within their provisioned sandboxes, preventing unauthorized modifications to host directories.
• Explicit Tool Permissions: Rather than granting broad ambient privileges, administrators assign specific, explicit tool capabilities to each coworker, ensuring clear boundary enforcement during delegated tasks.

By enforcing strict session and filesystem isolation, engineering teams can delegate high-context operational workflows without risking system-wide integrity or sensitive credential leakage.

AG-UI Protocol Integration and Real-Time Human-in-the-Loop Governance

Integrating autonomous workers into production operations requires both visual transparency and dependable human oversight. OpenBot pairs protocol standardization with active governance:

• AG-UI Protocol Standardization: Through AG-UI protocol support, agents built using existing frameworks or custom scripts can be registered seamlessly as coworkers with distinct communication channels. Outputs are not restricted to plain text or static markdown; agents render rich, interactive UI components such as forms, metrics graphs, and actionable buttons directly within client dashboards.
• Live Screen Observation: Users can view the agent's virtual desktop in real time via live streaming, observing clicks, form submissions, navigation paths, and document handling as they unfold.
• Instant Control Handover and Return: When an agent encounters sensitive verification steps, CAPTCHAs, two-factor authentication prompts, or edge-case failures, human operators can instantly seize keyboard and mouse controls. Once the manual action or verification is resolved, control is handed back to the agent to resume automated task execution.

This dynamic balance between autonomous execution and immediate human override directly resolves operational deadlocks while preserving safety on high-stakes tasks.

Docker Compose Self-Hosted Deployment and Pre-Configured Coworkers

OpenBot is architected as an infrastructure-agnostic, self-hosted platform that organizations can deploy directly onto internal hardware or private cloud instances.

• Docker Compose Orchestration: The entire software stack—including the administrative web UI, agent orchestration runtime, isolated sandbox containers, and a local PostgreSQL database—is orchestrated and launched with standard Docker Compose commands.
• Local Encrypted Credential Storage: To prevent dependency on any single proprietary model vendor, administrators register foundation model API credentials directly within the system, where keys are encrypted and stored locally.
• Three Bundled Declarative Coworkers: The repository includes three pre-configured agents ready for immediate evaluation, defined declaratively through configuration files rather than hardcoded logic:
  • General Assistant: A versatile coworker tuned for daily web research, document summarization, and multi-step operational tasks.
  • Knowledge: An internal knowledge specialist designed to index, search, and synthesize insights across company documentation and internal repositories.
  • Risk Analyst: A specialized agent configured to review operational documents, evaluate procedural compliance, and surface structured risk assessments.

Practical Operational Caveats and Resource Considerations

Before deploying OpenBot into team environments or mission-critical workflows, engineering teams should factor in several operational constraints.

First, OpenBot is currently in an active Alpha development phase. Core interfaces, API endpoints, and AG-UI protocol bindings may undergo breaking changes across subsequent releases, and teams should anticipate edge-case stability issues.

Second, resource footprint considerations are substantial. Because each active coworker launches its own dedicated browser instance and container sandbox, executing multiple agents concurrently increases host CPU and memory utilization. Infrastructure provisioning should be sized carefully based on expected concurrency.

Third, authentication defaults must be hardened. To simplify local prototyping, OpenBot defaults to single-user mode (OPENBOT_SINGLE_USER=true). When deploying across collaborative teams or exposing instances across internal networks, administrators must configure formal OAuth authentication and granular access controls to safeguard shared data and agent sessions.

Sources

• CopilotKit OpenBot GitHub Repository: CopilotKit/openbot
• RoundtableSpace on X: @RoundtableSpace Public Announcement