CopilotKit's OpenBot runs AI agents in isolated containers behind a policy gateway

CopilotKit has released OpenBot, an open-source platform that deploys AI agents as governed coworkers, each running inside its own isolated virtual computer. According to the announcement post on dev.to, every action an agent attempts, from shell commands to browser navigation to tool calls, is checked by a fail-closed policy gateway before it executes, and the outcome is recorded in an audit ledger.

The problem it targets

The dev.to post describes a trust gap that has opened up as the industry moves from single-turn chat assistants toward autonomous agents that browse the web, manipulate files and run scripts. Letting an agent execute arbitrary shell commands or drive an engineer's personal browser profile inside a corporate network creates major operational risk, while confining agents to read-only sandboxes leaves them unable to handle real developer work. OpenBot's answer is to give agents full working environments that are simultaneously isolated and auditable.

One container per coworker

OpenBot is self-hosted, deployed with Docker Compose and PostgreSQL inside a company's own infrastructure. Each bot is provisioned as a persistent worker rather than a throwaway script, with a dedicated Docker container, a private /workspace volume and its own browser profile, so agent logins, downloaded dependencies and compiled code never touch the host system. For stricter isolation, the platform supports optional gVisor runsc kernel sandboxing. Human teammates can watch agents work on a live screen, review their execution activity, or step in mid-task.

Governance before execution

The security model is centralized and fail-closed: no agent action proceeds without explicit, audited authorization. Policies are written in Common Expression Language (CEL) and evaluate intent, target domains, file paths and shell arguments before anything runs. Every permitted action, refusal and error is written to a searchable audit ledger exposed at /admin/audit, and secrets such as passwords and environment credentials are encrypted at rest and masked out of transcripts.

A human handoff for the hard moments

When an agent hits a multi-factor authentication prompt, a CAPTCHA, or a decision it flags as high-risk, it pauses and requests assistance. An operator can take over the browser canvas directly from the web interface, complete the authentication, and hand control back to the agent, a capability the project calls "Take the Wheel."

Built on AG-UI

OpenBot is framework-agnostic because it speaks the open AG-UI protocol. Any compliant endpoint, whether built with LangGraph, CrewAI, Mastra, Pydantic AI or custom code, can register as a coworker. Agents can also move beyond plain markdown replies and render interactive React components such as live dashboards, forms and data inspectors into user channels. The dev.to post shows a single docker run command pulling the image from GitHub's container registry, with an embedded PostgreSQL option for local setups.

Why it matters

Agent capabilities are rapidly becoming commodity; enterprise trust is not. The unresolved question for autonomous agents is less what they can do than who checks what they did, and OpenBot's design, combining pre-execution policy evaluation, container isolation, a searchable audit trail and human takeover, is a concrete blueprint for answering it. Self-hosting also sidesteps the data-residency concerns that block many managed agent products from enterprise adoption. One caveat is worth noting: these claims come from a single announcement post, and the real-world strength of the CEL policy model, the audit tooling and the sandbox defaults will only become clear through production deployments. Even so, the release signals where the agentic stack is heading, with governance treated as a first-class architectural primitive rather than an afterthought bolted on after agents are already running.