Instinct's AI Agent Wants Your Data Forever
Instinct's private-testing AI assistant is stunning testers with its capabilities — but its terms of service and security flaws reveal a troubling trade-off: unmatched convenience for perpetual data access. Here's what the launch exposes about the regulatory gap eating away at consumer AI.
The Magic Has a Price Tag You Didn’t Read
Instinct is one of the most capable personal AI agents ever tested in private, and everyone who’s used it says so. Testers call it magic. Jesse Middleton, a founder-turned-investor, wrote that after trying Hermes, OpenClaw, Tasklet, and GrokBot, Instinct takes the cake for travel rebooking, email follow-ups, CRM management, even working LP data rooms.
But the people praising it are also the ones discovering, often too late, exactly what they signed away.
Instinct — operated by San Francisco-based Spear Street Technology, led by former Sierra research scientist Noah Shinn — connects to your email, your messages, your calendar, your screen, your audio, your location. It books reservations. It finds flights. It sends emails on your behalf. And its terms grant the company a perpetual, irrevocable, sub-licensable license to access, store, modify, and use any of your material, including for training its own models.
That last word — perpetual — is doing a lot of work.
What Happens When You Try to Leave
The first warning sign came from Peter Yang, an early tester. He asked Instinct to delete his Gmail records. It didn’t. The team later added a tool for deleting external data, but the incident revealed something structural: Instinct indexes everything you allow it to touch, and the indexing is not easily reversible.
Claire Vo disconnected Instinct from her Google account at 11 a.m. At 2 p.m., the agent summarized her inbox. When she asked why, the bot confirmed the emails were stored in plain text for later searches. Disconnecting the API access did not stop the data retention.
This is not a bug. It’s the business model.
The terms make this explicit. Instinct receives your screen captures, your cursor movements, your keyboard inputs. It can enter into binding agreements on your behalf. It can send emails without checking with you first — as Katie Jacobs Stanton of Moxxie Ventures discovered when the agent sent an innocuous email without her approval. She called it a breach of trust and disconnected immediately.
We’re trading privacy and control for hyper-personalized AI tools without fully understanding the trade.
— Katie Jacobs Stanton
Every successful action earns a little more trust. One unauthorized action can reset that trust to zero.
The Phishing Problem Nobody Is Solving
Alex Cohen, co-founder of Hello Patient, built a test specifically designed to exploit Instinct’s architecture. He created a new Gmail account, emailed instructions to his real personal account, and watched Instinct carry them out through his authenticated session. The system was this easy to manipulate. He deleted his account.
This isn’t a hypothetical vulnerability. It’s a direct consequence of giving an AI persistent, authenticated access to your communications — access that doesn’t require multi-factor verification, doesn’t flag suspicious behavior patterns, and doesn’t distinguish between a command from you and a command crafted to look like you.
Cohen’s conclusion was blunt: we’re not at the point where it’s safe to give AI read-write access to your inbox.
Michael Mignano, founder of Anchor (acquired by Spotify) and now a GP at Union Square Ventures, put it even more broadly. Products like Instinct will change modern security norms for consumers, he said, adding that people will increasingly hand over passwords to third-party apps, unaware of how or what they are storing for them.
The shift is already underway. The safeguards aren’t.
The Regulatory Gap Is the Real Story
Instinct has raised eyebrows and closed fundraising rounds. Kleiner Perkins and Conviction have invested, according to multiple investors speaking to TechCrunch. The company operates in stealth. Its team hasn’t responded to requests for comment. On X, where testers circulate screenshots of the terms and complaints about data retention, the company has stayed silent.
Meanwhile, the regulatory framework for consumer AI agents doesn’t exist in any meaningful form. The EU’s AI Act covers high-risk systems and some transparency requirements, but personal AI assistants operating in private testing — agents that handle your most intimate data, act on your behalf, and retain your information indefinitely — fall into a gray zone. No jurisdiction currently requires disclosure of perpetual data retention policies for consumer AI. No regulator is auditing whether these agents can actually be disconnected.
OpenClaw’s founder left to join OpenAI on personal agents. Poke, another messaging-based assistant, exited to Cognition. The sector is moving fast. The rules are nowhere to be found.
Who Wins, Who Loses
The winners are clear: Instinct’s investors, its founders, and the early adopters who benefit from a tool that genuinely works. The agent outperforms expectations. It’s impressive technology.
The losers are everyone else — us, actually — who will inherit the norms this product establishes. When Instinct trains on your emails, your conversations, your plans, your vulnerabilities, and retains that data perpetually, it’s not just a privacy issue. It’s a precedent.
The next agent won’t have to promise less. It will just be harder to notice what it’s taking.
The question Instinct’s launch forces us to confront isn’t whether personal AI is useful. It is. The question is whether we’ll allow the default terms of that usefulness to be perpetual, irrevocable, and unregulated — or whether we demand that agents be designed with exit routes that actually work, data retention that respects user consent, and security models that don’t treat phishing as an edge case.