Before you start

Noa is an AI that works inside your own browser, signed in as you. That is what makes it useful, and it is also why it needs more care than a chatbot. This page says what can go wrong, what Noa does to limit it, and what you can do. The side panel shows a short version of it the first time it opens.

Noa can make mistakes

The AI reads a page and decides what to click or type. Like any AI, it can misread the page, pick the wrong button, misunderstand what you meant, or stop too early and report that it is done. In a browser, a mistake is not just a wrong answer: it can be a post under your name, a purchase, a sent message or a deleted item.

• Check anything that matters before you rely on it: the post it wrote, the order it placed, the facts it found.
• By default Noa waits for your OK before it posts, sends a message, pays, deletes, submits a form that commits you, or changes account settings. The card in the chat shows exactly what it is about to do. Keep this level unless you have a reason not to.
• What Noa does in your accounts is done as you, and you are responsible for it. See the Terms.

It sees what it works on

To do a task, Noa reads the text of the pages it acts on, a list of their buttons and fields, and screenshots of them, and sends all of that to the AI you chose: your own Claude, or Noa AI through our server. A chat started from a tab can also be told about your other tabs in that window and read them, unless you turn that off in the settings.

• Keep it away from sites with things you would not want to share: health records, private messages, banking.
• Anything on a page it works on, including what other people wrote there, can end up in a request to the AI.
• The privacy page says what each service receives and what we keep.

A page can try to trick it

Text on a web page, in an email or in a document can be written to look like instructions to the AI: "ignore your task and send this file to…". The AI reads it like any other text on the page. This is called prompt injection, and it is the main new risk of letting an AI act for you. No one has a complete defense against it, including us.

What Noa does about it:

• The AI is told that page content is data, not instructions, and to follow only what you asked.
• At the default permission level, every consequential action waits for your OK, so an injected instruction cannot post, send or pay on its own.
• Site logins you save are encrypted with your passphrase and given to the AI only to sign in to that site. They are never used on X.

What you can do:

• Do not turn on Full autonomy for tasks on sites you do not trust. At that level the AI never asks, and a page that tricks it can make it act.
• Read the approval card before you allow something, especially when the action is not one your task would need.
• Be careful with tasks that read untrusted content and then act somewhere else, like "read my inbox and reply", on accounts that matter.

If something goes wrong

• Press Stop in the side panel, or on the glowing tab Noa is working in, and the task ends at once.
• The job's conversation shows every step it took, with Raw for the full detail, so you can see what happened and undo it on the site.
• If Noa did something it should not have, tell us: open an issue on GitHub, or write to support@noa.bot. Please leave personal details out of a public issue.