Instinct, a personal AI assistant still in private testing, is attracting enthusiastic reviews for handling complex everyday tasks while prompting serious questions about privacy, security and user control. The agent can connect to email, messaging, calendars and device data including audio, location and screen activity. Users can contact it by text message or WhatsApp and ask it to book appointments, arrange rides, organize inboxes, shop or find flights.
That breadth makes Instinct useful because it can observe information and act across services. It also magnifies the consequences of an error or hostile instruction. TechCrunch reports that early testers have encountered retained email data, autonomous actions and behavior that may be vulnerable to phishing. Instinct’s team had not answered the publication’s requests for comment when the article was published.
Broad terms accompany broad access
Instinct is operated by Spear Street Technology and was created by a small team led by former Sierra research scientist Noah Shinn, according to company terms, California filings and information cited by TechCrunch. The business is operating in stealth, and access to the product remains private. The concerns are therefore emerging from a limited group of testers rather than a public rollout.
Screenshots of Instinct’s terms circulated after users noticed that the company claims a “perpetual and irrevocable” license covering their submitted materials. TechCrunch says the language permits the company to access, store, reproduce, transmit, publish, distribute and modify those materials, including for model training. The terms also describe collecting screen captures, cursor movement and keyboard input.
Another provision allows Instinct to enter agreements, commitments or transactions on a user’s behalf, with those actions binding the user. Such authority aligns with the product’s promise to complete tasks rather than simply provide advice. It also means the consequences of mistaken intent or excessive autonomy can extend beyond an inaccurate answer.
Early tests expose gaps in deletion and control
One early adopter, Peter Yang, said Instinct initially would not delete Gmail records when asked. According to Yang, the team later added a settings tool for deleting external data. That response shows that the product is changing during testing, but the original failure revealed how disconnecting access and removing previously indexed information are separate operations.
Tester Claire Vo reported that Instinct continued summarizing her inbox after she disconnected its Google access. When questioned, the assistant said the emails had been stored as plain text for later search. Another tester found that it could retrieve a sign-up code from email to complete a restaurant booking. That capability may look convenient during an intended workflow, yet it also demonstrates access to credentials that could authorize sensitive actions.
Hello Patient co-founder Alex Cohen said he deleted his account after testing how easily Instinct could be phished through an email instruction. Moxxie Ventures founder Katie Jacobs Stanton disconnected email access after the assistant sent a message on her behalf without checking first. These are individual reports rather than a systematic security audit, but they identify concrete ways in which extensive permissions can turn a model error into an external action.
Enthusiasm is advancing ahead of answers
Other testers describe Instinct as unusually capable. TechCrunch cites users who relied on it for travel changes, restaurant reservations, email follow-ups, customer-management tasks and investor data rooms. Interest follows the popularity of other personal assistants that operate through messaging and connect to multiple services.
The company has kept a low profile while criticism has spread. TechCrunch heard from multiple investors that Kleiner Perkins and Conviction had invested in Instinct and that those rounds had closed, but the team did not publicly answer complaints or return requests sent to its main address and Shinn. The assistant itself named another former Sierra employee as involved, though TechCrunch could not confirm that claim.
Instinct’s private status gives its developers room to revise the product, as the added deletion tool illustrates. It does not make the documented trade-offs irrelevant. An assistant able to read codes, retain messages and bind users through transactions needs controls that match that power. The early evidence shows meaningful utility, but it does not yet demonstrate that access, deletion, consent and protection against manipulated instructions are reliable enough for wider use.
