The personal AI assistant Instinct is facing early scrutiny because of the breadth of its permissions and its terms of use, even though it remains available only through a private test and has not yet reached the public on a wide scale. Early users have praised its ability to perform complex tasks, while others have warned that the level of access and autonomy granted to it may come at the expense of privacy and control.
Instinct was developed by a small team led by Noah Shinn, a former researcher at Sierra, and is operated by Spear Street Technology in San Francisco, according to its terms of service and California business records. The company is operating in stealth mode and, as of the publication date, had not responded to requests for comment sent to its main email address or directly to Shinn. TechCrunch also reported that investors told it that Kleiner Perkins and Conviction had invested in the company, without publishing details about the rounds or their value.
Permissions That Go Beyond Executing Commands
Instinct connects to the user's applications and devices, including email, messaging apps, and calendars, as well as audio, location, the screen, and more. Users can communicate with it through text messages or WhatsApp to request appointment and restaurant bookings, schedule a trip to the airport, organize their inbox, arrange information, shop, or search for low-cost flights.
However, the terms of service grant the company, according to screenshots circulated by users, a “perpetual and irrevocable” license to access, use, host, store, copy, transfer, display, publish, distribute, and modify user materials, including using them to train AI models. The terms also indicate that the company may collect information from devices, such as screenshots, cursor movements, and keyboard inputs.
The terms also state that Instinct can enter into agreements, obligations, or transactions on behalf of the user, making them binding on the user. This is not merely a technical permission to perform a step within an application; rather, it is a delegation that may have contractual or financial consequences, making clarity of consent and verification mechanisms central factors in the service's design.
Early Experiences Reveal Concerning Issues
User Peter Yang said that Instinct did not delete Gmail records when he asked it to, before the team later added a tool for deleting external data in the settings, according to Yang. Claire Vo found that the assistant continued summarizing her inbox after access was disconnected, after which the bot explained to her that the email messages had been stored in plain-text form to make them searchable later.
Another user raised concerns after the assistant was able to extract a sign-in code from their email to complete a restaurant reservation through Resy. Alex Cohen, co-founder of Hello Patient, also said that he deleted his account after discovering how easily Instinct could be exposed to phishing. Katie Jacobs Stanton, founder of Moxxie Ventures, said that the service sent an email on her behalf without requesting prior confirmation.
Why Does This News Matter?
These cases show that the value of a personal assistant is determined not only by its ability to perform tasks, but also by the limits of what it can read, store, send, and do in the user's name. Michael Mignano, founder of Anchor and currently a general partner at Union Square Ventures, said that these products could change consumer security standards, particularly as people become more likely to hand passwords over to third-party applications without knowing how they are stored or used.
The reported experiences do not establish that Instinct poses a widespread risk, as it is still in private testing, and some issues were later addressed, according to user accounts. But the source does not provide a public response from the company to the objections, nor does it adequately clarify the limits of data retention or the consent mechanism before sensitive actions are carried out. The central question therefore remains open: Do deletion tools, prior confirmation, and permission restrictions provide practical safeguards commensurate with the level of access required by this type of assistant?