n8n Ships Nod, an Open-Source Personal Agent With Its Own Computer: 98 Percent of 226 Test Errands Completed, Zero Unsafe Actions

n8n, the company behind the widely used open-source workflow automation platform, has released a research preview of Nod — a personal AI agent that does real errands on real websites from the user's own machine. The project appeared on GitHub under the n8n-io organization as a free, open-source download, with active commits shipping through November 13, including desktop builds for macOS 14 or later on Apple silicon and Intel, a Windows 11 preview, and Linux x64 support packaged as a Flatpak.

The pitch is everyday work that eats afternoons: chasing invoices, prepping one-page briefs for each call from your calendar and the client's latest news, drafting replies from your own pricing sheet, canceling trials you forgot about. Nod works across Gmail, Calendar, Slack, Notion and the open web, and it asks before it acts — anything a rule does not explicitly cover waits for the user's yes. Interaction happens through a desktop app, Telegram or WhatsApp.

Architecturally, Nod is deliberately boring in the best sense: one Node.js process and a few Docker containers, all on the machine running the agent. The stack is TypeScript on Node.js 24, Fastify, React, PostgreSQL with pg-boss for job queues, the Pi agent runtime, an agent-browser layer, Composio, MCP and Electron. Two containers do the isolation work — a Linux workspace sandbox and a dedicated Chromium browser container — so web interactions never touch the host directly.

The trust model is where the design gets opinionated. Policy lives in the server, not the prompt: the trust check, spending limits, payments and the Vault run outside the model's reach. App, web and browser results reach the model marked as data rather than instructions, which blunts prompt injection by construction. Provider keys never enter the workspace or the browser sandbox; the Vault types passwords, codes and card details privately into websites. Every action and sign-in lands in a Usage view with costs and a monthly API limit attached.

It is model-agnostic in a way most agent products are not. Nod supports OpenAI, Anthropic, Gemini, OpenRouter, Bedrock, Vertex AI and Azure — more than 20 providers in all — or a self-hosted model server, and users can sign in with a ChatGPT Plus or Pro subscription instead of managing API keys. Memory learns from the user's own messages, never from the pages and emails the agent reads, and every stored note is visible, editable or forgettable with its source message attached.

The evaluation numbers, published in the repo and labeled as test results rather than guarantees, deserve scrutiny in both directions. In October 2026 runs against simulated accounts and websites using GPT-6.1 Sol, Nod completed 98 percent of 226 errands run three times each, recorded zero unsafe actions across all 678 runs, scored 93.2 percent recall on LongMemEval-S, and produced zero false memories out of 216 in WhisperBench attack tests. A separate trust-check evaluation found GPT-6.1 Sol and Claude Opus 5.5 got all 240 test decisions right, while Claude Haiku 5.5 let 8 unsafe actions through — a useful signal that the safety of this category depends on the model as much as the harness.

Nod arrives into a crowd of personal agents — OpenAI's dots, Meta's Muse, Anthropic's Claude Duet — but its positioning is the opposite of theirs: local-first, source-available, model-optional, with the data, memory and saved logins staying on hardware the user controls. The research-preview label is honest, and simulated errands are not production Gmail accounts. But as a reference design for what a trustworthy personal agent architecture looks like — policy in the server, secrets out of the sandbox, untrusted-by-default web results — it sets a bar the hosted incumbents will be measured against.