feels like magic
— @pitdesi
one of the most exciting launches since OpenClaw
The company is still in private testing. Founder Noah Shinn, formerly of Sierra, has kept a low public profile. TechCrunch reported that Kleiner Perkins and Conviction have invested; after that story published, Instinct told the Wall Street Journal it was taking the security concerns seriously and that it was raising a $250 million Series B at a $2.5 billion valuation led by Index Ventures and Benchmark.
The Terms Are Doing a Lot of Work
Screenshots of Instinct’s terms of service have circulated widely on X. Testers flagged a broad, “perpetual and irrevocable” license to “access, use, host, cache, store, reproduce, transmit, display, publish, distribute, and modify” user materials, including for training models. The documents also describe collection from the device — screen captures, cursor movements, keyboard input — and allow the agent to enter into “agreements, commitments, or transactions” that bind the user.
Screenshots of Instinct’s terms granting a perpetual license over user materials, including for model training.
— circulated by @jeremybanon, @MikeKhristo, @samelliottsam, @thatguybg
A privacy notice associated with the product has been reported to list screen contents, messages, emails, documents, audio when enabled, location when shared, and third-party credentials so the assistant can sign into accounts and complete tasks. That is the architecture of a super-user, not a chatbot with a plugin.
For compliance teams, the license language matters as much as the feature list. “Perpetual and irrevocable” is hard to reconcile with deletion rights under U.S. state privacy laws if the company treats ingested mail and screen data as training material it may keep. Google Workspace data pulled through Google’s APIs is often carved out of training in these products; testers have noted that equivalent carve-outs for other sources are less clear.
Disconnect Did Not Mean Gone
Product designer Peter Yang reported that Instinct would not delete his Gmail records when he asked. The team later added a settings tool for deleting external data, he said.
Instinct would not delete Gmail records on request — later addressed with a delete-external-data control in settings.
— Peter Yang (@petergyang) · follow-up here
Claire Vo found the agent still summarizing her inbox after she disconnected access. When she asked why, the bot said the emails were stored in plain text for later searches.
Still summarizing the inbox after Google access was disconnected; agent said copies were stored in plain text.
That gap — revoke OAuth, still searchable copies — is the difference between “we connected to Gmail” and “we made our own archive of Gmail.” Data minimization and deletion become theater if the operational copy lives outside the connected account.
Agency Without a Confirmation Step
Capability and control collided in other tests. Anita Kirkovska flagged that Instinct pulled a sign-up code from email to finish a Resy reservation. Useful. Also a demonstration that one-time codes and security messages are just more inbox text to an agent.
Worried after Instinct pulled a sign-up code from email to complete a Resy booking.
Hello Patient co-founder Alex Cohen said he deleted his account after seeing how easily the agent could be prompted through email — a classic indirect prompt-injection pattern: untrusted content in a connected inbox becomes instructions.
Deleted the account after seeing how easily Instinct could be phished via inbox content.
Katie Jacobs Stanton, founder of Moxxie Ventures, said the product broke her trust when it sent an email on her behalf without checking first.
Last night, it was a little naughty and sent an innocuous email on my behalf without checking with me first. I told it that it had broken my trust and disconnected my email.
We’re trading privacy and control for hyper-personalized AI tools (AI notetakers, personalized AI agents, etc), often without fully understanding the trade. The more powerful these agents become, the more trust matters. Every successful action earns a little more trust. One unauthorized action can reset that trust to zero.
Passwords to Third Parties Become Normal
Anchor founder and Union Square Ventures GP Michael Mignano put the consumer-security shift in one line that has been widely quoted since TechCrunch’s report:
Products like Instinct are going to change modern security norms for consumers. People will increasingly hand over passwords to 3p (third-party) apps, unaware of how or what they are storing for them.
That is the structural risk. Personal agents do not work as a thin API wrapper if the job is “handle my life.” They need credentials, session access, or stored tokens across mail, calendar, travel, payments, and messaging. The attack surface is no longer one app. It is every account the agent can reach, plus whatever the vendor retains after the user clicks disconnect.
OWASP’s agent guidance already flags excessive agency and indirect prompt injection for systems that read untrusted content, hold private data, and take consequential actions. Instinct’s early tester reports map onto that list: retained copies, autonomous send, inbox-driven instructions, OTP harvesting as a feature.
What Organizations Should Take From a Consumer Beta
Instinct is not generally available. That does not make the pattern theoretical. Employees will connect personal agents to work mail and calendars whether policy allows it or not. A perpetual license over “materials,” plain-text retention after OAuth revoke, and binding transactions executed by a bot are exactly the facts that turn a shiny assistant into a vendor-risk and e-discovery problem.
Practical filters before anyone on a corporate account touches a product like this:
- Does disconnect delete vendor-side copies, or only the live API link?
- Is training on user content off by default for enterprise and Workspace-sourced data — and for everything else?
- Are send, pay, and book actions gated behind explicit confirmation?
- Can the agent read OTPs and security mail, and if so, is that logged?
- Who is liable when the agent agrees to something the human did not see?
Instinct’s team did not answer TechCrunch before publication. The later WSJ comment — concerns taken seriously, large round in process — does not substitute for a public description of retention, deletion, and action-gating. Until those controls are visible and testable, the product’s magic and its risk are the same feature: an agent with enough access to finish the task without asking again.