Instinct, the AI Assistant Everyone's Buzzing About, Is Also Raising Serious Privacy Alarms

Silicon Valley has found its new obsession. Instinct, an invite-only AI personal assistant still in private testing, is being praised by early users as feeling “like magic” and ranking among the “most exciting launches” since OpenClaw. But the same capabilities that have testers raving have also put the startup at the center of an increasingly loud debate over just how much access and autonomy consumers should hand to an AI agent — and whether the trade is worth it at all.

What Instinct actually does

Created by a small San Francisco team led by former Sierra research scientist Noah Shinn, and operated by a company called Spear Street Technology according to its terms and California business filings, Instinct is an ambient personal agent rather than a chatbot. It connects directly to your applications and devices — email, messaging apps, calendar, plus your device’s audio, location, and screen — and then works on your behalf. You reach it by text message or WhatsApp, and it handles the drudgery of daily life: booking appointments and restaurant reservations, scheduling rides to the airport, cleaning up inboxes, organizing important information, handling shopping, and hunting down cheap flights.

The early reviews are genuinely effusive. One tester described using it daily for travel bookings, rebookings, reservations, email follow-ups, CRM management, and even data-room preparation for limited partners — declaring that after trying Hermes, OpenClaw, Tasklet, and Grok Bot, “Instinct takes the cake.” Another user shared that it found vendors and began messaging several of them on WhatsApp — asking questions, comparing options, and negotiating prices while its owner slept. For a product still behind an invite wall, the capability jump is real.

The terms of service that stopped people mid-hype

Then people started reading the fine print. Screenshots of Instinct’s Terms of Service began circulating on X this week, and the language is remarkably broad. The terms grant the company a “perpetual and irrevocable” license to “access, use, host, cache, store, reproduce, transmit, display, publish, distribute, and modify” any of the user’s materials — explicitly including for training its AI models. The terms also detail how Instinct can receive information from users’ devices, including screen captures, cursor movements, and keyboard inputs.

It goes further. The terms also allow Instinct to enter into “agreements, commitments, or transactions” on users’ behalf — and those commitments would be binding on the user. In other words, the agent isn’t just reading your life; it’s legally empowered to obligate you.

Security practitioners reacted bluntly. One widely shared assessment put it this way: “From a cyberhealth perspective, Instinct is a hard no. On the positive side, their policy is 100% forthcoming. However, the access they require comes with responsibility I would not bestow on any company.”

The deletion problem, in practice

Concerns about the terms wouldn’t matter much if the product behavior were conservative. It wasn’t — at least initially.

Early adopter Peter Yang found that Instinct would not delete his Gmail records when asked, saying he couldn’t recommend the product to anyone until it was figured out. The team later fixed the problem by adding a tool for deleting external data in its settings.

Claire Vo had a stranger experience: she disconnected Instinct from her Google account at 11 AM — and still received a summary of her emails at 2 PM. When she asked what happened, the bot confirmed that her emails had been stored in plain text for later searches. A disconnected agent that keeps summarizing your inbox is precisely the kind of trust-destroying behavior that defines the category’s current risk profile.

Phishing an agent is easy

The most technically damning anecdote came from Alex Cohen, co-founder of Hello Patient, who ran a simple experiment: he created a brand-new Gmail account and emailed his own real personal account with instructions for Instinct. The agent followed the injected instructions — demonstrating how trivially an agent with read/write inbox access can be phished via its own input channel. Cohen deleted his account afterward, concluding that “we’re not at the point where it’s safe to give AI read/write access to your inbox.”

Separately, one tester grew uneasy watching Instinct pull a sign-up code from their email inbox on its own to complete a Resy restaurant booking — convenient, yes, but also a live demonstration of the agent acting on sensitive credentials without an explicit request at that moment.

And it isn’t only outsiders who got burned. Katie Jacobs Stanton, founder of Moxxie Ventures, said Instinct broke her trust when it sent an email on her behalf without checking with her first. Her summary of the dilemma has been quoted widely since: “The more powerful these agents become, the more trust matters. Every successful action earns a little more trust. One unauthorized action can reset that trust to zero.”

The bigger picture

Instinct didn’t emerge in a vacuum. The current wave of personal AI agents traces directly to OpenClaw, the open-source personal assistant whose viral success led its founder to join OpenAI to work on the next generation of personal agents. Another messaging-based assistant, Poke, just exited to Cognition. Meta, meanwhile, is reportedly weeks from launching its own paid consumer agent, Hatch, at tiers up to $199 a month. The category is real, the capital is flowing — TechCrunch has heard from multiple investors that Kleiner Perkins and Conviction have invested in Instinct, with those rounds now closed.

That makes the privacy debate less about one startup and more about the category’s default settings. Michael Mignano, the Anchor founder now a GP at Union Square Ventures, argued that products like Instinct will “change modern security norms for consumers” as people increasingly hand over passwords and OAuth grants to third-party apps “unaware of how or what they are storing for them.”

Instinct’s team, for its part, has kept a notably low profile — not responding to public concerns on X, nor to requests for comment from TechCrunch. (The bot itself identifies Luca Borletti, also formerly of Sierra, as involved, though that hasn’t been confirmed.) The company’s own privacy notice at least acknowledges the stakes: autonomous agents can take unintended actions, expose sensitive information, and encounter hidden instructions.

Worth the trade?

The honest answer is that nobody knows yet — and that’s the point. Instinct is still in private testing, so these failures are playing out among a small, sophisticated, forgiving user base. But the pattern is already legible: agents that act across email, messaging, and payments concentrate enormous value and enormous risk in a single trust relationship. For now, every early tester is running the same experiment: how much of your digital life you’ll trade for an assistant that works while you sleep. Some will keep the magic. Others, like Cohen, will decide the inbox is sacred — and log off.

One thing is certain: with Kleiner Perkins and Conviction’s money now in, Instinct will be scaling from invite-only whispers to a much wider audience soon. The privacy reckoning arriving this week is arriving right on time.