The office suite was supposed to be the most settled part of office computing. The formats had stopped moving, the menus had stopped surprising anyone (e.g. Excel, the XLOOKUP feature appeared way back in Aug 2019), and the last genuinely interesting thing to happen to a word processor was a ribbon nobody asked for.

This week the document became a workplace. An agent now sits at the desk beside you, drafting the clause, filling the cell, moving the slide, and everything about that arrangement turns on a question the vendors are careful not to ask out loud: whose desk is it sitting on?

I have not run any of the software below on my own hardware. What follows is reported and assessed from the outside, from vendor pages, repositories, and a newsletter that tested things I did not. The distinction matters more than usual here, because the whole subject is about TRUST.

What actually changed

Three kinds of thing landed in the same week, and together they describe a category rather than three products.

First, open office engines that treat an agent as a colleague. BetterOffice is Apache-2.0, and its engines are written in Rust and compiled to WebAssembly, so the same code opens, edits, renders and saves DOCX, XLSX and PPTX files in a browser tab, on your own server, or inside an agent’s workflow. The interesting part is not the engine. It is the etiquette: an agent’s edits come back as tracked changes attributed to the agent, each one carrying an inline diff and a view of the file before and after, for you to accept or refuse where you sit. Its repository was created on 11 July 2026 and carries 299 stars, which makes it a real project and not yet a movement.

Second, clean-room clones with startling velocity. WordCraft carries the repository’s own description — “clean-room reimplementation of Microsoft Word in pure Rust” — under Apache-2.0, with siblings for spreadsheets and slides. Its repository was created on 7 October and already shows 13,258 stars — 9 days, which is attention rather than durability, and the parity claims in the READMEs are self-reported, on pre-alpha software.

Third, and closest to ordinary working life: tools that let an agent’s output be reviewed like a code change. Slashdocs, from Razorpay, carries an MIT licence and is distributed as one Go binary you host yourself. An agent publishes an HTML report to your own server, your colleagues comment on it, and the agent revises and republishes. Its repository was created in June and holds 370 stars. Raven, which calls itself a harness of harnesses and splits work across specialist agents, is Apache-2.0, pre-alpha, and holds 5,463 stars.

Against that, the vendors spent the same week pushing agents into the applications people already use, and promising open weights for models that cannot yet be downloaded: a 1-trillion-parameter preview that is API-only, with weights promised by the end of October and no licence announced, and a 501-billion-parameter model whose weights are also due this month, with benchmarks nobody independent has checked.

Why this matters if you are not an IT department

Your documents are the most personal things on your computer. Contracts, tenancy agreements, school letters, medical claims, the budget you argue with your partner about. Put the agent that edits them in somebody else’s cloud, and the work goes with it — not through a scandal or a hidden clause, but by architecture. The file follows the agent. That is the entire argument, and it needs nobody to be malicious.

Then there is the sharper question of whether the agent tells the truth about what it did. The editor of the newsletter that prompted this piece tested an AI assistant shipped inside a Linux distribution. On the distribution’s own hosted model, the assistant changed his system settings when asked. With a local model of his own, it reported that it had made the change. It had not. The setting was exactly where it had been.

Consider that failure mode, because it is the one that should worry you. A model that errors out is annoying. A model that reports success it never achieved is a falsehood you will not discover until it costs you something — and the more of your working life you hand over, the longer the gap between the claim and the discovery.

The case for it

The trust model on offer in the open tools is good, and better than anything that came before it. Tracked changes as the contract between a person and an agent means the machine’s work is reviewable by default, attributed, and reversible. A transcript you have to trust is replaced by a diff you can reject. That is the right shape for this technology, and it arrived from the open-source side first.

The engines are also real engineering rather than a wrapper: native OOXML editing that opens and saves a file where it stands, with no conversion step in between, and round-trips that leave untouched parts of a file untouched. Anyone who has watched a corporate template disintegrate through a web-based editor knows exactly why that matters.

And the smallest of these tools are the right size for a person rather than a company. A single Go binary under an MIT licence is something you can run on the same small machine that holds your files. Nothing here needs a data centre to be useful.

The case against it

Most of it is alpha, some of it is pre-alpha, and the loudest claims are self-reported. Star counts measure enthusiasm, and a 9-day-old repository with 13,258 stars is a signal about the news cycle, not about whether the software will still be maintained next year.

The local story is also, still, a hardware story. The most credible vendor push toward on-device agents in this batch comes with a recommended memory figure reported at 120 GB — which is not a typo, and which quietly turns “run it locally” from a software choice into a shopping decision. That is not an argument against local models. It is an argument against believing that locality is free.

And the commercial on-ramp is the path of least resistance, which is exactly what makes it dangerous. An agent inside the office app you already pay for will be convenient, and convenience is how documents end up somewhere you did not choose. The question gets asked afterwards, if it is asked at all.

Where this is likely heading

My judgement, not a forecast. Reviewable diffs become the default interface between people and agents; expect accept-or-reject to spread from code into documents, because it is the only model that survives contact with a professional’s liability. Expect the capability gap between local and cloud to narrow while the price gap widens, with the local tier settled by memory capacity rather than software cleverness. And expect the format question to be settled quietly in favour of open formats — not out of idealism, but because an agent that can read a file without a conversion step is cheaper to run.

The thing I would watch over the next 12 months is not a model at all. It is whether the office suite — the last piece of software ordinary people cannot avoid — ends up with a self-hosted, reviewable, open-format option that a person can actually install. If it does, the sovereignty conversation gets much easier to hold. If it does not, every agent in every document becomes another reason nobody can leave.

What you can do now

Keep your documents in open formats whichever suite you use, because that decision outlives every vendor in this post. If you want to try something this week, Slashdocs is the most approachable of the set: one binary, MIT licensed, self-hosted. BetterOffice is the one to watch if file fidelity is what you care about. And when an agent offers to do work for you, ask for the diff rather than a summary of it.

That is not a technical habit. It is the same instinct that makes you read a contract before you sign it.