n8n's Nod Is Here: What Lawyers and Founders Should Check Before Giving a Personal AI Agent the Keys

What n8n Labs Released

n8n Labs, an experimental team inside n8n, released Nod this week as a research preview. Press reports from Toolnavs and Unite.AI date the release to November 10, 2026. The Nod launch page describes a personal agent with its own computer that "chases invoices, preps your calls and cancels trials, on real websites," and that "asks before it acts for you." The launch announcement in the n8n community forum warns: "Expect rough edges and frequent updates."

The errands n8n showcases look a lot like a solo practitioner's or founder's week:

• Call briefs: each morning it reads your threads, your calendar and the client's latest news, and writes a one-page brief for each call.
• Unanswered questions: it finds the question you never answered, like a client's pricing ask from last week.
• Invoice chasing: it sends friendly reminders and asks before a second nudge.
• Trial cancellations: it cancels, turns down the offers to stay and asks for a refund.
• Month-end paperwork: it downloads bank and tax statements and files them by name.

Nod is free and licensed under Apache 2.0. It runs on macOS 14 or later, and Windows 11 support is in preview and requires WSL 2. There is no Linux desktop app, but you can host Nod on your own server for one person. Whatever machine runs it has to stay on and awake. Nod is its own app and does not require n8n. If you are weighing n8n's workflow platform instead, see our guide on whether n8n belongs in your automation stack.

You also bring the model. Nod works with any of 30+ providers, including OpenAI, Anthropic, Google and OpenRouter, or with a ChatGPT Plus or Pro plan. Local models through Ollama, LM Studio, vLLM or llama.cpp also work. They need tool calling and a 64,000-token context, and n8n cautions that "small models are less reliable at the safety check."

The roadmap adds an always-on Nod that you don't have to host yourself, phone calls "for the errands that still need a voice," and a few people sharing one Nod. Several of today's errands already involve client messages and financial accounts. Phone calls and shared agents would raise the authority and confidentiality questions that the rest of this guide covers.

Why an Agent That Acts Is a Different Legal Animal

A chatbot's mistakes usually stay on the screen until you copy them somewhere. An agent like Nod is built to act: it sends the message, cancels the trial and files the statement. Its mistakes happen in the world. The Nod launch page says Nod works "on your word," and n8n's own example shows what that means. Nod notices that a client, Sara, asked in Slack, "What would pricing look like for 3 videos?" and never got an answer. It pulls your pricing sheet from Notion and drafts a reply. If you approve that draft, you have quoted a price.

So who is bound when the agent speaks? The Uniform Electronic Transactions Act (UETA) answers directly. Section 14 says a contract "may be formed by the interaction of electronic agents of the parties, even if no individual was aware of or reviewed the electronic agents' actions or the resulting terms and agreements." It also says a contract may be formed "by the interaction of an electronic agent and an individual," which is the situation when Nod messages a client. The official comments add that "the requisite intention flows from the programing and use of the machine." The comments to the Act's definitions also call an electronic agent "a tool of that person," and the person using a tool is generally responsible for what it does. Texas adopts the same rule in Tex. Bus. & Com. Code § 322.014. Agency law points the same way. A Duke Law & Technology Review article notes that the Restatement (Third) of Agency "views computer programs as mere instrumentalities of the using person."

Two caveats apply. We have not found a reported case that applies these rules to an agent driven by a large language model, so the framework suggests an answer but does not settle it. Enactments also differ. New York's ESRA does not expressly address electronic agents, so check your own state's statute. The safe working assumption is that what Nod sends, you sent. Proskauer recommends human approvals and spending limits for this reason. We cover contracting authority in more depth in our post on who pays when your autonomous tool binds your company. Writing those approval rules for a firm is part of our AI and tech governance practice.

Where Your Data Goes (and Why Lawyers Should Care)

Nod's default setup is good for privacy (relatively). The Nod FAQ says it "stores your database, files, memory, and saved logins on the computer or server that runs it." But storing data on your own machine does not keep it there. The same answer goes on: "Model services, apps, and websites receive the data they need for your tasks." In practice, several parties can see part of your work:

• Your model provider. According to the Nod README, it "gets what each task needs."
• The connection service. By default, app connections "use n8n and Composio" and run through a service that n8n hosts. Composio is an integration layer that, by default, stores app credentials such as OAuth tokens, encrypted, on its own cloud.
• n8n. Usage data sharing is on by default for new users. You can turn it off under Settings → Privacy & data.
• Websites and apps that Nod signs into for you.

For lawyers, any of these flows that carries client information falls under Model Rule 1.6(c). It requires "reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." The ABA applied this duty to generative AI in Formal Opinion 512 (July 29, 2024). As a baseline, the opinion says lawyers should read and understand the "Terms of Use, privacy policy, and related contractual terms and policies" of any AI tool they use. Before client information goes into a self-learning tool, the lawyer needs the client's informed consent, and "merely adding general, boiler-plate provisions to engagement letters purporting to authorize the lawyer to use GAI is not sufficient." With Nod, the most important terms are your model provider's. Check whether it trains on your inputs and how long it keeps them.

Whether you need consent when a provider's contract says it does not train on your inputs depends on the facts; the opinion calls the risk analysis "fact-driven." Bars may answer differently, so check your state bar's guidance. Supervision duties also apply. Opinion 512 says managerial lawyers must set "clear policies" on AI use, and it adds supervisory obligations when lawyers "rely on others outside the law firm" to use AI tools for a representation. A sensible approach is to treat Nod like nonlawyer help under Rule 5.3: set its rules, check its work, and know who its vendors are.

Approvals, Mistakes, and the Limits of a Model's Judgment

Nod's main safeguard is an approval check. The launch page says Nod "checks each action against your request and rules, and asks when they don't cover it." According to the Nod README, the check runs on every app action and on every website step that can change something. Results from apps, websites and the browser reach the model "marked as data, not instructions." The forum announcement is blunter: "an email or web page can't give Nod permission." That is a careful design.

n8n is also open about where that design stops. The FAQ answers "Can it make mistakes?" this way: "Its safety check is a model's judgement, and Nod is an experiment." The launch page reports zero actions without permission across 678 test runs and a 98% finish rate on 226 errands. It also reports 93.2% on LongMemEval-S, a published academic memory benchmark, and 0 of 216 attempts to plant false memories on WhisperBench. These figures come from n8n itself, were measured on one model (GPT-6.1 Sol), and we found no independent replication. n8n adds its own caveat: "Your results depend on your model and the sites you use."

The threat behind that last number is real. In the research that introduced WhisperBench, an attack tool called MemGhost, delivered in a single email, succeeded 87.5% of the time against another personal agent, OpenClaw, running GPT-5.4. n8n's test used the 108 published attack emails, not attacks tuned against Nod itself. The WhisperBench paper also tested three purpose-built defenses: two missed the attack more than 90% of the time, and a safety-tuned model still let about half of the attacks through. A Cloud Security Alliance research note describes the risk for any agent that watches an inbox. OWASP lists prompt injection as its first LLM risk, including instructions hidden in websites or files, and recommends human approval for privileged operations.

Approvals have a weak spot of their own. If you see dozens of prompts a day, you may stop reading them. Proskauer notes that users who get used to automation may approve transactions without reviewing them carefully. So don't rely on clicking "approve." Write narrow rules for anything that speaks or pays for you: Nod sends nothing to clients, opposing counsel or courts, and pays nothing, without your explicit sign-off.

Saved Logins, Website Terms, and Who Is Really Signing In

To work on websites, Nod uses logins you save during setup, and it signs in as you. n8n handled the mechanics with care: a built-in vault enters passwords, codes and cards privately on the website, and every sign-in shows up in Usage. When Nod clicks "I agree," though, the site sees you. UETA's official commentary says a person who clicks "agree" should be bound by that click. Having an agent do the clicking for you probably does not change that.

Bank, payment and client-portal terms may restrict automated access or credential sharing, so read yours before you give Nod a login. In Van Buren v. United States (2021), the Supreme Court held that the Computer Fraud and Abuse Act's "exceeds authorized access" clause covers entering off-limits areas of a computer. It does not cover using information you can already reach for an improper purpose. But footnote 8 left open whether limits in contracts or policies count. Contract claims remain either way. In LinkedIn's dispute with hiQ Labs, a federal district court held that terms barring scraping and fake profiles were enforceable in a breach-of-contract claim, and the parties then stipulated to a $500,000 consent judgment.

The practical answer is to give Nod its own identity wherever a site allows it. That means a separate account or delegated access, only the permissions each errand needs, and multi-factor authentication everywhere. If Nod's vault holds your sign-in codes as well as your passwords, both factors sit on the same machine, so secure that machine accordingly. OWASP's advice to restrict a model's privileges "to the minimum necessary" covers its logins too. Our guide to least-privilege OAuth scopes and token storage for n8n Gmail integrations applies the same discipline to one common connection. Check Usage regularly to see where Nod has signed in.

Open Source and "Research Preview" Cut Both Ways

Nod's open code has real benefits. The license file in Nod's repository is the Apache License 2.0. That license gives you a "perpetual, worldwide" right to use and modify the code. You or a consultant can read how the approval check and the login vault work. You can run Nod on your own server, and because you have the code, you are less locked in to one vendor, though by default app connections still run through n8n and Composio. n8n also invites users to "change how Nod works in the open code, and send it back."

The same license puts the risk on you. Section 7 of Apache 2.0 provides the software "AS IS," without warranties, and says "You are solely responsible for determining the appropriateness of using" it. Section 8 excludes contributor liability for damages, "including any direct, indirect, special, incidental, or consequential damages." Now add the UETA rule from earlier. If Nod sends the wrong quote, the message is probably treated as yours, and whether it binds you turns on ordinary contract law. The license is written to leave you with little or no claim against the people who wrote the code. We saw no SLA or paid support terms for Nod on the launch page or in the README.

The README also calls Nod "a research preview," and you should take that label at face value. Nod is a reasonable tool for low-stakes pilots. It is not yet ready to be a system of record for client work.

Actionable Next Steps

Before Nod handles anything that matters, work through these steps in order.

1. Start with your own errands. Try Nod first on low-stakes tasks that don't involve clients, such as cancelling your own trials, before it touches a client matter.
2. Choose the model deliberately. Before you connect a provider, read its terms on training and retention. If you use a ChatGPT Plus or Pro plan, check whether its data terms differ from the API terms. Local models keep your prompts away from a model provider and are an option for sensitive work, though apps, websites and the connection service still receive task data, and n8n warns that small models are less reliable at the safety check.
3. Close the side channels. Turn off Share usage data under Settings → Privacy & data. Review the apps connected through n8n and Composio and check where their tokens are held. Composio offers self-hosted and private-VPC options as well as its default cloud.
4. Put approval rules in writing. Nod sends nothing to clients, opposing counsel or courts, and pays nothing, without your sign-off. Set a monthly spending limit on API models too.
5. Give Nod its own accounts. Use separate logins or delegated access, give each errand only the permissions it needs, and turn on multi-factor authentication.
6. Review Usage weekly and update your paperwork. Usage lists every action, sign-in and cost. If client data will pass through Nod, cover it in your firm's written AI-use policy. If your model provider can train on or otherwise learn from client inputs, get the client's specific informed consent first; under Opinion 512, standard engagement-letter language will not be enough. If the provider does not train on inputs, check your state bar's guidance.

Nod already includes most of these controls. Your part is deciding which errands it may run, then adding new ones one at a time.