n8n Labs shipped Nod on November 10 — a local-first, Apache 2.0 personal agent that opens a sandboxed Chromium on your machine, completes multi-step jobs on real websites, and keeps every credential, log, and memory on your device. No cloud middleman. Bring your own model. Zero unsafe actions in 678 test runs.
That last number is the one worth paying attention to.
Safety Lives in the Server, Not the Prompt
Most agent projects handle safety with carefully worded system prompts. That approach breaks the moment a web page tries to hijack the agent with an injected instruction. Nod takes a different architectural path: policy runs server-side, outside the model’s reach entirely.
The Vault stores your credentials, passwords, and payment cards on-device and injects them into the browser without ever passing the raw values to the model. A trust check runs server-side before any action that sends, pays, posts, or deletes. Web content is returned to the model explicitly marked as “data,” not “instructions.” In their published benchmarks, 13 prompt injection attempts landed zero successes. In 678 real task runs, there were zero unauthorized actions.
One caveat before you get comfortable: a third-party report found that the Claude Haiku model variant let 8 unsafe actions pass. The safety guarantees are real, but they depend on which model you wire in. GPT-6.1 Sol is the one with the clean benchmark record so far.
What Nod Actually Does
The official task list gives you the target use case in concrete terms. Nod is designed to handle:
- Chase an invoice until it’s paid
- Cancel a forgotten subscription and recover the refund
- Turn client requests into Linear tasks
- Generate weekly reports automatically
- File month-end paperwork
- Book a team offsite
Nod handles these by spinning up a Linux sandbox on your machine with a Chromium instance inside it. The agent clicks through real websites the same way you would — not via API, not via scraping — which means it works anywhere a browser works. When it reaches an action that’s irreversible, it pauses and asks before proceeding.
Local-First as a Real Privacy Architecture
Cloud-first agents have a structural data problem: everything the agent reads while completing your task passes through a third-party data center. Manus is cloud-only with no local credential isolation, and it’s now owned by Meta following the December 2025 acquisition. OpenAI Operator was removed from ChatGPT in August 2026. If your tasks involve sensitive business data, those architectures create compliance exposure regardless of the vendor’s privacy policy.
Nod inverts the model. The Linux sandbox, Chromium, PostgreSQL job queue, and memory all run on your hardware. Provider keys never reach the workspace or the browser. Working data never traverses the public internet. For teams operating under HIPAA or SOC 2, that structural isolation matters more than any contractual assurance from a cloud provider.
Bring Your Own Model
Nod connects to OpenAI, Anthropic, Gemini, OpenRouter, Bedrock, Vertex AI, Azure, and local models via standard API configuration. This model agnosticism is not just a checkbox — it’s the reason the safety architecture needs to be model-independent. As the Haiku finding shows, different models have different risk profiles. By keeping policy enforcement outside the model, Nod gives you a consistent safety floor regardless of which inference provider you choose.
Developer Details
The stack is TypeScript on Node.js 24, Fastify, React, PostgreSQL with pg-boss for job queuing, the Pi agent runtime, agent-browser, Composio for OAuth connectors (Gmail, Slack, Notion, Google Drive), MCP, and Electron. It’s Apache 2.0, so forking and self-hosting are fully supported. The self-host documentation covers Docker deployment.
The MCP integration is worth noting if you already use n8n: Nod can call any of n8n’s 70+ workflow integrations as tool surfaces, connecting a personal agent to your existing automation infrastructure. The GitHub repository is public under Apache 2.0.
Still a Research Preview
n8n Labs is explicit: Nod is not production-ready. Built-in app authentication is listed as “coming soon.” The 98% completion benchmark comes from a single model tested over a single month. The benchmark methodology page is public, which is more transparency than most agent projects offer — but verify on your own workloads before trusting it with anything irreversible.
Official guidance from n8n: start with a low-stakes task — cancel a newsletter, fetch a receipt — before connecting Vault to a payment card. That’s reasonable advice for any tool that acts on the web on your behalf. The full announcement has the complete overview if you want to start from the source.
The architectural bets here are sound. Policy-in-server, Vault-based credential isolation, and local execution are the right foundations for a personal agent that handles anything sensitive. Whether Nod delivers on those foundations at production scale is the question the research preview is designed to answer.
