AI assistant Instinct sparks controversy over email access

Testers have called the assistant "magical" and named it one of the most interesting launches since the personal AI assistant OpenClaw. One tester said they'd used Instinct for travel booking and rebooking, restaurant reservations, email follow-ups, CRM management, and even organizing a data room for investors, adding that after trying Hermes, OpenClaw, Tasklet, and GrokBot, Instinct came out on top.

What's buried in the terms of service

The catch is what you give up in exchange for that level of access. Multiple users have shared screenshots of Instinct's terms of service, flagging language that grants the company a "perpetual" and "irrevocable" license to "access, use, host, cache, store, reproduce, transmit, publish, distribute, and modify" user data. That license extends to using the data for training AI models. The terms also state that Instinct can receive screen captures, cursor movements, and keystrokes from a user's device.

An even more contentious clause goes further: the terms say Instinct can enter into "contracts, agreements, or transactions" on the user's behalf, and that any such deals are legally binding on the user. That's a step beyond an AI booking a reservation for you — it means the AI can commit you to legally binding agreements you never directly signed off on.

Real incidents, not just hypotheticals

These aren't just theoretical concerns — several actual incidents have already surfaced. Early user Peter Yang said he asked Instinct to delete his Gmail history, but the request wasn't carried out. He noted the team later fixed the issue by adding a tool in settings that lets users purge external data.

Another user, Claire Vo, said she disconnected her Google account at 11 a.m., only to receive an inbox summary again at 2 p.m. When she asked Instinct what happened, she says it told her that her emails had been stored as plain, unencrypted text for future search purposes.

User	Issue encountered	Outcome
Peter Yang	Email deletion request wasn't honored	Team added a deletion tool as a fix
Claire Vo	Email summaries continued after disconnecting	Confirmed emails were stored in plain text
Alex Cohen	Tested phishing vulnerability with a new Gmail account	Deleted the account
Katie Jacobs Stanton	Email sent without confirmation	Disconnected email integration

Questions about the security model

Alex Cohen, co-founder of Hello Patient, said he wanted to test how easily Instinct could be phished, so he created a new Gmail account and sent an email containing instructions to his real account. After confirming the result, he deleted the account. Another tester said they were unsettled to see Instinct pull a verification code directly from their inbox while handling a task on the restaurant booking site Resy.

Katie Jacobs Stanton, founder of Moxxie Ventures, said her trust in the assistant broke down after Instinct sent an email on her behalf without asking for confirmation first. "One unauthorized action can reset trust to zero," she wrote on X. Michael Mignano, founder of Anchor and now a venture capital partner, noted that products like Instinct "are going to change consumer security habits" altogether, as more people hand over passwords to third-party apps without knowing what's actually being stored.

Who's behind the company

According to California business registration records and the terms of service, Instinct is operated by a company called Spear Street Technology. The person leading the effort is Noah Shinn, a former research scientist at Sierra, who built it with a small team. PitchBook data shows the company is still operating in stealth mode. The bot itself claims that Luca Borletti, also formerly of Sierra, is involved, though that has not been independently confirmed.

Multiple investors who spoke with TechCrunch said Kleiner Perkins and Conviction have backed the startup, and that the round has already closed. Even as the controversy continues, the Instinct team has kept a low profile, not responding to any of the criticism or complaints raised on X. Requests for comment sent to the startup's general email address and directly to Noah Shinn have gone unanswered.

Part of a broader wave of personal AI assistants

Interest in Instinct and personal AI more broadly picked up after OpenClaw, a personal AI assistant known for its powerful feature set, took off — its founder later joined OpenAI to work on next-generation personal agents. Poke, another text-message-based assistant, recently exited the market after being acquired by Cognition. Around the same time, the ChatGPT Mac app added a feature letting it read and reply to Apple Messages on a user's behalf — part of the same trend. As more AI assistants arrive with deep access to personal data, the trade-off between convenience and control over your own data is becoming a pattern across the whole industry.

Editor's take

What makes the Instinct case interesting isn't that the company hid anything — it's that the controversy erupted even though everything was disclosed upfront. As one tester pointed out, the company's policy was "100% honest." The problem was the sheer scope of the authority it honestly wrote down. A perpetual, irrevocable data license and the power to enter contracts on a user's behalf aren't experimental clauses a small startup threw in for fun — they look more like the baseline requirements the company decided an agent needs if it's actually going to act on your behalf. This is exactly the point where an AI assistant's real usefulness collides head-on with how much risk a user can reasonably tolerate.

That's also why this feels so different from the previous generation of AI assistants — the kind that just scheduled a calendar appointment and not much else. Those older assistants worked fine with limited permissions. But something like Instinct, which reads your entire inbox, replies on your behalf, and even makes payments, can't get by on read access alone. It needs write access, delete access, even contract-signing authority — and once you hand that over, walking it back can be much harder than expected, as Claire Vo's case shows.

For any company or team considering plugging a personal AI assistant like this into daily operations, there's a clear minimum bar to check right now. First, actually test whether deletion requests are carried out immediately. Second, confirm that disconnecting the service cuts off access completely and right away. Third, dig into the terms of service to find out exactly what actions the assistant can take automatically, without asking you first. Handing over a full company email account before confirming all three is still a premature move.

What to watch over the next few weeks is how Instinct responds to this scrutiny. Given that it already added a deletion tool once, the team will likely revise its terms or add more opt-out options — and how quickly it moves will probably shape how investors like Kleiner Perkins and Conviction approach the next funding round.