Independent AI intelligence Two editions daily · ET
Fervor AI
Menu

Analysis · November 14, 2026 · repo

n8n Nodagent-securityagent-harnesslocal-ai

n8n's Nod Moves AI Agent Rules Out of the Prompt and Into a Server

The new open-source personal agent from n8n Labs puts its guardrails in a server, not the prompt. The catch is who enforces them.

Most AI agents keep their rules in the same place they keep everything else: the prompt. "Never send an email without asking." "Don't buy anything over $50." Those lines sit in the model's context next to the web page it just read and the email it just opened.

Which is the problem. If the rules are text, and the web page is text, then a clever web page can argue with the rules. That's what prompt injection is: someone else's words sneaking into your agent's instructions.

Nod, a personal agent from n8n Labs released as a research preview on November 10, takes a different line. Its README says it plainly: "Policy lives in the server, not the prompt." The rules about what Nod may send, pay, post or delete run in code outside the model.

That design is worth stealing. It also has one honest gap: the check that applies those rules is itself a model. So the model you pick for Nod stops being only a cost choice and becomes part of your security.

What Nod is

n8n is the workflow automation company. Nod comes from n8n Labs, which the launch post describes as "a new team within n8n that experiments with ideas outside our core product."

Nod is "a personal agent with its own computer and browser." You tell it what you need, in its app or over Telegram or WhatsApp, and it works through your apps and websites until the job is done. The repo's own one-line description gives the flavor: it "chases invoices, preps calls and cancels trials on real websites, and asks before it acts."

The "own computer" part is literal. Per the launch post, "Nod works inside a private virtual machine on your computer, with its own browser." Under the hood the README describes "one Node process and a few Docker containers, all on the machine that runs Nod." Your files, memory and saved logins stay on that machine. Your model provider gets what each task needs.

It's open source under Apache 2.0, free, and you bring your own model: an API key from OpenAI, Anthropic, Gemini, OpenRouter, Bedrock, Vertex AI, Azure and others, or a ChatGPT Plus or Pro sign-in. The launch post says a model running on your own computer works too. As of November 14 the repo sits around 1,100 stars, and the team shipped three releases on November 13 alone, ending at v0.7.6.

How the rules stay out of the model's reach

Picture a bank teller with a manager. The teller can talk to customers, fill in forms and hand over paperwork. When a customer asks for a large withdrawal, the teller doesn't get to decide. The manager checks it against the account rules. A customer can be very persuasive with the teller. They never talk to the manager.

Nod splits the work the same way. The model is the teller. The server is the manager. The README lists the pieces:

  • Every risky step gets checked. "The server checks each app action, and each website step that can change something, against your request and rules. Anything they don't cover waits for your yes."
  • Outside content is data, not orders. "App, web, and browser results reach the model marked as data, not instructions." The launch post puts it more bluntly: "A web page or an email can't give Nod orders."
  • Keys stay outside the sandbox. "Provider keys never enter the workspace or the browser."
  • Secrets stay outside the model. A component called Vault "enters passwords, codes, and cards privately on the website," through forms the launch post says "the model can't read."
  • Money has a ceiling. The launch post says Nod "checks in with you once a task passes $5, and you can change that amount," and you can set a monthly spending limit. Every task ends with a receipt.

Put together, that's a strong shape. The model can be fooled into wanting something. It can't type your card number, because it never sees it. It can't send the Slack message, because the server holds the send button until the request matches what you asked for.

The gap: the manager is also a model

Here's the part n8n is upfront about. The check that decides whether an action matches your request isn't a fixed rulebook. The launch post says: "The permission check is itself a model and can make mistakes, which is why Nod asks when your words don't cover an action." Asked whether it can make mistakes, the README answers: "Yes. Its safety check is a model's judgement, and Nod is a research preview."

So the teller-and-manager picture needs one correction. The manager is trained on the rules, follows them very well, and is still a person who can be confused by an odd request.

That changes what matters. The architecture separates outside content from policy and marks it as data, which makes the easy injection much harder. n8n doesn't claim it removes the risk. What's left is the quality of the judge.

And Nod's own README puts a number on that. Under "Pick a capable model," it says: "In 240 test decisions, GPT-6.1 Sol and Claude Opus 5.5 got every one right. Claude Haiku 5.5 let 8 unsafe actions through."

That one line is the insight of the whole project. On most agent tools, choosing a cheaper model is a cost decision. You trade some quality for a smaller bill. On Nod, the model you pick also sits behind the permission check, so a cheaper model is a looser lock. Eight unsafe actions out of 240 is about one in thirty. For an agent that can pay bills, that's not a rounding error.

Read the README's headline numbers with that in mind: "98% tasks finished (226 errands, 3 runs each)" and "0 unsafe actions in those 678 runs." Those were run on GPT-6.1 Sol in October 2026, "in simulated accounts and websites," and the README labels them "test results, not a guarantee." They're n8n's own measurements on n8n's own test set. They tell you what a strong model does on the setup n8n built. They don't tell you what your cheaper default does on your inbox.

Put this into practice

If you want to try Nod, start small and set the knobs before you hand it anything real.

1. Install it. The easiest path is the desktop app from nod.n8n.io for Mac or Windows. The README lists macOS 14 or later, with Windows 11 and Linux x64 as previews, and says setup takes about ten minutes. To run from source on macOS or Linux, install Node.js 24.21 or later, pnpm and Docker, then:

git clone https://github.com/n8n-io/nod.git
cd nod
corepack enable
pnpm start

2. Pick the model on purpose. Use one of the models the README says passed all 240 decisions, or something you've tested yourself. If you want to save money, save it on a task you'd be fine redoing, not on the model guarding your accounts.

3. Set the money limits first. Lower the per-task check-in below $5 if you're nervous, and set a monthly limit before you connect a card. The launch post warns that "some early testers found tasks cost more than they expected." Treat the first week as calibration.

4. Turn off what you don't want shared. The README says Nod "shares basic usage data with n8n, on by default for new users." Turn off Share usage data in Settings → Privacy & data if that bothers you. App connections also go "through a connection service that n8n hosts by default," so connecting your apps routes through n8n's service unless you change it.

5. Give it a boring first errand. Something reversible, like "find every unpaid invoice in my email from October and draft reminders, but don't send them." Watch where it stops to ask. Those stops show you what the check thinks your words cover, which is the most useful thing you'll learn in the first hour.

What to expect: Nod will ask more often than you'd like at first, because it asks whenever your request doesn't clearly cover an action. That's the design working. Write requests the way you'd brief a new assistant, specific about what's allowed.

Honest limitations

Nod is a research preview, and n8n says so everywhere. A few specifics:

  • It sleeps when your laptop sleeps. The launch post says so directly, and the README notes schedules only run while the machine running Nod is on. A hosted version is on the roadmap.
  • One owner per install. It's a personal agent, not a team tool.
  • It needs Docker and Node.js 24.21 or later if you build from source, and a model either way. That can be a paid provider or, per n8n, a compatible local model, though the product site says a local model needs tool calling (the ability to request actions in a structured format) and a 64,000-token context, roughly enough working memory to hold a long task.
  • The safety check is probabilistic. The server-side design makes the easiest attacks harder. It doesn't make the judge perfect, and n8n doesn't claim it does.
  • The benchmarks are n8n's own, on simulated sites with one strong model.

None of that is a reason to skip it. It's a reason to treat it the way n8n does, as an experiment you supervise.

What to take from Nod, even if you never install it

The most portable idea here isn't Nod itself. It's the split. If you build agents, ask where your rules live. If the answer is "in the system prompt," every web page your agent reads gets a vote. Move the rules that matter (sending, paying, deleting) into code that runs outside the model, keep secrets where the model can't read them, and put a spending ceiling on the whole thing.

Then remember the part Nod's README is brave enough to print: if a model enforces those rules, the model is part of your security. Pick it like it is.

Sources: n8n-io/nod README and releases (v0.7.6, reviewed November 14, 2026), Meet Nod launch post (November 10, 2026), nod.n8n.io.