Open WebUI 0.13.3: Coding agents in chat – who controls the machine?
Open WebUI links chat, local coding agents and scheduled automations. The benefit is tangible, but machine, file and tool permissions need equally concrete limits.
Version 0.13.3 adds coding agents to scheduled runs. It does not automatically solve permissions, auditing or terminal availability.
1. What actually shipped on 8 November
Version 0.13.1 surfaces coding agents as models when the connected Open Terminal offers them. Users may chat or speak to agents, choose reasoning effort and service tier, and approve tool requests inside the chat. Agent conversations are limited to one agent per conversation and lack some regular chat edit/regenerate actions. If the underlying terminal disappears, new activity falls back to the default model.
Version 0.13.3 adds agent selection to the automation editor. Scheduled runs persist the selected terminal and working folder, checking their availability when execution starts, and deliver results to a chat. This is a product feature, not proof that unattended workloads always complete safely or reliably.
2. Tether moves the trust boundary
Open WebUI describes Tether as a companion for macOS, Windows and Linux which links a real computer to the browser interface. The connection is outbound, without opening inbound ports. Through a configured connection, models and agents can operate on local files, repositories and tools, with terminal output recovering after disconnections.
That makes the permissions discussion concrete. An agent that used to answer questions about a repository may now be able to modify it. Device connectivity alone is not authorization to read secrets or write everywhere; teams must separately govern processes, filesystem paths, network access, review and recovery.
3. Auto tool approval is not a security boundary
In 0.13.1 an optional Auto permission mode joins Full access and Ask for approval. It is off by default. A review model examines tool calls with their arguments and recent conversation context, approving calls it judges safe; errors, timeouts and excessive context fall back to a request for approval.
Editorial assessment: this can reduce repetitive human approvals but cannot replace deterministic policy enforcement. Teams should assess where the scoring API receives data, whether the underlying tool has broad privileges, and how unsafe approvals would be detected and reversed.
4. AgentenCode deployment decision matrix
| Capability | Released scope | Pre-deployment check |
|---|---|---|
| Claude Code, Codex, Pi in model picker | 0.13.1; a suitable connected Open Terminal required | Agent account, terminal boundary, approvals |
| Tether desktop companion | 0.13.1; macOS, Windows, Linux | Local paths, repository rights, session expiry, disconnection |
| Scheduled coding agents | 0.13.3; selected terminal and folder stored with the job | Execution identity, offline failure, audit and retry |
| Auto tool approval | Optional, off by default | Review API data sharing, access policy and human fallback |
Decision: Start with a read-only pilot on a non-production repository. Any writes, package installation, secret access or production deployment should require independent access limits, explicit review and recoverable changes.
5. Three practical pilot tests
First ask an agent to summarise a test repository without changing files. Next request a proposed patch only as a diff, subject to human review. Finally schedule a report in a separate working folder, test failure when the bound terminal is offline, and capture who approved each action. A green run is not a general safety certification.
6. Availability and limitations
Official 0.13.1 and 0.13.3 releases were published 8 November 2026. The release notes do not establish that every linked model provider, agent subscription, terminal, or compute resource is universally free. Supported features depend on deployment, companion availability and underlying accounts. Agent chat regeneration/editing limitations remain relevant.
7. FAQ
Do all Open WebUI chats now support coding agents? No; the connected Open Terminal must provide them.
Can scheduled agents run without the machine being online? The notes describe a saved terminal/folder and availability checking, not an unconditional guarantee of execution.
Does Auto permission mode make agents safe? No. It is a model-based decision layer, not a proven sandbox or substitute for enforceable permissions.
8. Original sources and editorial method
- Official Open WebUI v0.13.1 release notes
- Official Open WebUI v0.13.3 release notes
- Open WebUI upstream project
Method: Features and dates are attributed to maintainers; the decision matrix, threat analysis and pilot design are independent editorial interpretation. No hands-on security audit, reliability benchmark or pricing verification.