n8n Nod: A Local Personal Agent With Its Own Browser

On November 10, 2026, n8n Labs released Nod — a standalone, Apache 2.0 personal agent that runs on your Mac or Windows PC, carries its own sandboxed computer and browser, and finishes multi-step jobs on real websites after server-side policy checks. CEO Ophir Prusak announced it on the n8n blog as a research preview: not a feature inside n8n, but a separate app for people who want an agent that can click through checkout flows, chase invoices, or cancel trials without handing them back as a to-do list.

For builders comparing harnesses, Nod sits next to OpenAI's cloud-browser work mode, Perplexity Teammates, and Cloudflare's personal-agent controls — but it keeps files, Vault logins, and browser state on hardware you control.

TL;DR

What Nod is trying to solve

Chat tools excel at planning; they weakly own execution. You still open tabs, copy MFA codes, and wonder whether the model saw a prompt-injection paragraph in a terms-of-service box.

Nod's answer is architectural: give the agent its own machine inside your machine. The browser documentation says Nod spins a separate browser from your daily Chrome profile — no shared cookies, no accidental reuse of your personal saved passwords unless you put them in Vault.

That pattern mirrors enterprise agent sandboxes we cover in NVIDIA Agent Substrate on GKE and Microsoft Foundry long-running agents, but shrunk to a single-user desktop binary instead of a Kubernetes namespace.

How the sandbox and browser work

According to Nod's browser docs, the agent can open pages, click, fill forms, download files, and run JavaScript — but risky transitions pause for you. Steps that could submit, pay, or change something you did not ask for trigger a confirmation. Card payments using Vault always need approval.

When Nod hits a CAPTCHA or human check, it tries a few screenshot-guided attempts, then hands you the live browser in the desktop UI so you can solve the challenge and press Return to Nod. That design acknowledges a limit every headless agent hits: some sites block automated browsers outright.

Subagents and scheduled runs each get their own browser instance, which matters when you ask Nod to price three shops in parallel — the parent agent can fork work instead of serializing everything through one session.

n8n Nod personal agent automation inside an isolated browser sandbox on the user machine

Model providers and local inference

Nod's local model guide is explicit about two hard requirements: tool calling and 64k+ context. The stack reserves roughly 20k tokens for instructions and tools before your first message, so a default 4k context server will silently truncate behavior.

Supported local stacks include Ollama, LM Studio, vLLM, and llama.cpp behind an OpenAI-compatible URL. Nod also documents using a smaller model or decision service as the action checker when your main writer model is too large to trust for policy calls — a pattern reminiscent of separate judge models in agent benchmarks.

You can sign in with a ChatGPT Plus or Pro plan instead of API keys, which lowers the setup tax but ties reliability to OpenAI's consumer terms.

Security model in plain language

The GitHub README lists design choices that security reviewers will recognize:

• Policy in the server, not only in the system prompt.
• Untrusted content labeled as data so a hostile webpage cannot masquerade as instructions.
• Provider keys never enter the sandbox workspace or browser VM.
• Vault enters passwords and one-time codes without exposing them to the model transcript.

That is closer to AgentBeam-style separation than to a bare ChatGPT connector with full desktop access — though Nod is still beta software, not a certified compliance product.

Connectors use Composio and MCP per the README stack list, which means your threat model should include third-party OAuth scopes the same way you would for any MCP host.

What people are asking

"Is this just n8n with a chat box?" No. Langflow vs n8n compares workflow builders. Nod does not expose a node canvas; it is a packaged agent runtime (Pi agent, Fastify server, Electron shell, PostgreSQL job queue per GitHub).

"Can it replace OpenClaw?" Different trade-offs. Our OpenClaw guide covers a messaging-native personal assistant. Nod optimizes for website execution and Vault payments, not multi-channel chat personality.

"Will it leak data to the model provider?" Nod says inference goes to whichever API you configure; local models keep prompts on your LAN if the checker also stays local. Read the privacy page on nod.n8n.io before pointing it at regulated inboxes.

"Does it sleep when my laptop closes?" Yes. The blog post warns the agent pauses on sleep — testers use a Mac mini or VPS. That is the same operational lesson as always-on agent demos that assume data-center uptime.

Limitations and honest gaps

n8n labels Nod a research preview. Public docs list missing pieces:

• No phone-call channel.
• Single owner per install — not a team tenancy product.
• Laptop sleep stops work unless you self-host on always-on hardware.
• A hosted Nod is on the roadmap, not shipped.

If you need audited enterprise guardrails today, pair experimentation on Nod with the checklist patterns in rogue agent incident coverage — separate accounts, spend caps, and prompt-injection tests on every new site template.

How to try Nod today

1. Download from nod.n8n.io for macOS or Windows 11 preview.
2. Add a model connection (API key or ChatGPT plan sign-in).
3. Connect apps via OAuth (Gmail, Slack, Notion, etc.).
4. Start with a low-stakes web task — cancel a newsletter, fetch a receipt — before Vault stores a card.

For local models, set OLLAMA_CONTEXT_LENGTH=65536 (or equivalent) before pointing Nod at Ollama, matching the docs' worked example.

Developers can clone github.com/n8n-io/nod and run from source on Node 24 if you want to inspect the trust-check code paths directly.

Connectors, MCP, and the Composio layer

Nod's GitHub stack list names Composio and MCP beside Fastify and the Pi agent runtime. Practically, that means OAuth connectors (Gmail, Slack, Notion, Google Drive, Calendar) arrive as pre-built tool surfaces instead of custom scrapers you maintain.

For builders already running MCP servers in production, Nod is another host to test whether your tools survive real browser friction — duplicate dialogs, session timeouts, and CAPTCHAs. The difference from a bare Claude Desktop MCP plug-in is that Nod can complete the web steps between tool calls without you alt-tabbing.

If you self-host n8n workflows today, keep the products separate: schedule heavy ETL in n8n cron jobs; use Nod for one-off personal errands that do not deserve a permanent node graph.

Troubleshooting patterns early testers report

Nod's own docs flag recurring setup failures:

Document each failure in your personal runbook the same way teams log agent commerce benchmark misses.

Pricing and license reality

Nod software is free under Apache 2.0, but inference is not. You pay whichever provider you attach — OpenAI metered APIs, Anthropic usage, or your own GPU time for local models. Nod tracks usage and monthly API limits in-app per the README.

Because Nod is a research preview, there is no enterprise SLA, no SOC2 packet, and no guarantee feature names stay stable across weekly builds. Pilot it on personal inboxes before you point it at regulated customer support queues.

n8n Nod personal agent running policy checks before payments or outbound messages

Comparison with other personal agents (November 2026)

None of these replace IT-approved VDI for trade-secret code. They compete for personal productivity, where convenience and sandboxing trade off against vendor trust.

Why n8n shipped a second agent product

n8n's core business is durable automation graphs — the kind of product enterprises wire into support and ops stacks. Nod experiments with ad hoc agent loops that would be painful to express as static nodes.

The split also isolates risk: a sandbox escape or OAuth scope bug in Nod does not automatically imply the same flaw in self-hosted n8n workflows, though you should still patch both if you run them on the same admin laptop.

Related on explainx.ai

• Types of AI agents — workflow vs autonomous
• Perplexity Teammates persistent agents
• ChatGPT Work cloud browser
• Cloudflare personal agent policies
• Visa agentic commerce benchmark — where shopping agents fail
• Langflow vs n8n vs Make
• What is MCP

Release details and download URLs are accurate as of November 11, 2026, per n8n Labs' announcement and nod.n8n.io documentation.