How Cornelius AI works, and how it keeps you safe

Cornelius is your own AI assistant: an agent that can read, write and do things for you, not just chat. If you've never had one, this page explains what that means, what Cornelius can and can't do, and the protections built in so it never acts behind your back.

Back

What's an AI agent?

A chatbot answers questions. An agent can also use tools: look things up in your notes, read your email and calendar, search the web, make a document or a presentation, draft a reply, book a meeting. You ask in plain words ("what's on tomorrow, and draft a reply to Sam saying Thursday works") and it works out the steps.

That's powerful, and it's also why safety matters: an agent that can send an email could send the wrong one. So in Cornelius, the AI only ever proposes. Separate code, which the AI can't change or talk its way around, decides what actually happens, and anything that reaches outside waits for your yes.

How it works

1. You askType or speak, in plain words.

2. The brain plansAn AI model (Claude, GPT, Gemini, or one on your own computer) works out what to do.

3. It proposes"Search the notes", "read that email", "draft this reply"…

4. The gate checksCornelius's own code allows it, asks you, or refuses.

5. You approveAnything that sends or changes something outside shows you the exact details first.

6. It's recordedEvery action appears in Activity, with how it ended.

The parts

The brain: The AI model that thinks. You choose it, and can switch at any time: online models from Anthropic (Claude), OpenAI, Google (Gemini) and others, or a model running on your own computer, which works offline and never sends anything out. You can use your own API keys.
Memory: your notes and the galaxy: Your notes, documents and files, shown as a galaxy of connected stars. Cornelius answers from them and files new notes for you. Workspaces keep different parts of your life apart (a business, your job, the family).
Tools and apps: Gmail, Outlook, calendars, Google Drive, OneDrive, GitHub, Notion, Meta and more, connected by you, with the permissions you grant. Each app can be limited to the workspaces it belongs to.
Skills and routines: Skills are written instructions for how to do a kind of task (a weekly review, a proposal). Routines run steps on a schedule (a morning check of your inbox and calendar) and write you a report.

How we keep you safe

These protections are built into Cornelius's code, not just its instructions, and they're tested automatically every time it changes.

1. Nothing outside happens without your yesSending, booking, deleting, posting, uploading or running a command shows a card with the exact recipients, words, dates or files, and waits for you. Your approval works only for that exact action, once, and expires.

2. A permission gate, not the AI, decidesEvery tool is declared as reading, writing in Cornelius, acting outside or opening a web page. The gate checks each request. A connected app can't label its own "delete" as harmless, and new tools can't slip in unreviewed.

3. Your private things stay privateFolders and notes you mark private never go to an online AI. For client work, a workspace can be limited to the AI providers your agreement allows, with no quiet fallback to another.

4. Your keys and passwords are never shown to the AIThey're stored encrypted. Anything that looks like a key or token is blanked out before the AI reads a tool's result, and before logs or exported files are written.

5. It can't be tricked into acting by what it readsEmails, web pages and documents are treated as someone else's words, never as instructions. Notes written from them are marked "not checked yet" until you check them. After reading something from outside, changing your existing records needs your yes, and a web page address the AI makes up can't carry your data away.

6. Skills you didn't write are read firstA pasted or downloaded skill stays off until you've read it, and goes off again if it changes. Built-in skill packs are fingerprinted, so a changed file switches the pack off.

7. No accidental doublesThe same email or booking twice within minutes is refused. If a connection drops mid-send, Cornelius says it can't tell whether it went and doesn't try again on its own.

8. You can see everything and stop anythingActivity lists every action. Stop ends a task or routine part-way. Pause all actions halts everything that reaches outside. Revoke all apps disconnects them all at once. Your browser is also told to run code only from Cornelius itself.

What it can't promise

AI makes mistakes. Answers can be wrong, out of date or incomplete, even when they sound sure. Check anything important (money, legal, medical, safety, anything you'll send to someone) before you rely on it.

You're in charge of what you approve. Read the card before pressing Approve: Cornelius shows you exactly what will happen, but it's your decision.
It isn't professional advice. It's not a lawyer, accountant, doctor or financial adviser.
The AI providers see what you send them. When you use an online model, your question and the notes or emails it needs go to that provider (Anthropic, OpenAI, Google and so on) under their terms. Use private folders, client-confidential workspaces or a local model for anything that mustn't leave.
Connected apps follow their own rules. What Cornelius can reach in an app is what you granted when you connected it. You can disconnect any app, or all of them, at any time.
AI costs money. Online models charge for what they read and write. The Usage page shows which models were used and roughly what they cost (estimates; your provider's bill is the real figure).
Keep backups. Export your notes from time to time (Notes, Export .zip).
It keeps improving. Features change; the Guide inside Cornelius explains each one.

Where your things live

Your notes, documents, settings and the record of actions are kept by the Cornelius server you sign in to, in your account, separated from everyone else's. Keys and passwords are encrypted. Things only leave it when a model or an app needs them for something you asked, and only to the providers and apps you chose.

Your choices (what's kept, what local AI may read) and your data to download or delete are on the Privacy page. What's stored, who sees it and for how long: the privacy policy.

Questions or something that doesn't look right? Use Pause all actions on the Activity page, then ask the person who runs your Cornelius server. This page explains how Cornelius works; it isn't a legal agreement.