Instinct, an AI personal assistant still in private testing, has become a hot topic—not just for its impressive capabilities but also for the privacy concerns it raises. The agent, a self-proclaimed taskmaster, has been lauded by testers as feeling “like magic” and being one of the “most exciting launches” since OpenClaw. At the same time, some users have voiced worries about the AI’s security framework and its problematic terms of service. Since Instinct is still in private access, these issues haven’t yet reached the broader public, but they’re worth examining.

The tool is the brainchild of a small team led by Noah Shinn, a former research scientist at Sierra. Based in San Francisco, Instinct operates under Spear Street Technology, according to its terms and California business filings, and is currently running in stealth mode, per PitchBook. The AI works by connecting to your apps and devices—email, messaging platforms, calendar, and even your device’s audio, location, screen, and more. You can interact with it via text or WhatsApp, asking it to handle tasks like booking appointments, scheduling airport rides, tidying up your inbox, organizing key info, managing shopping, or hunting for cheap flights. Testers say it often outperforms expectations, but some have also flagged serious concerns about how the company handles customer privacy and security. That begs a timely question: is giving AI this level of access and autonomy actually worth the trade-offs?

For example, several people are sharing screenshots from Instinct’s Terms of Service, which grant the company a broad, “perpetual and irrevocable” license to “access, use, host, cache, store, reproduce, transmit, display, publish, distribute, and modify” any user materials, including for training its AI models. The terms also mention that Instinct can receive data from users’ devices, such as screen captures, cursor movements, and keyboard inputs. Additionally, the agreement allows Instinct to enter into “agreements, commitments, or transactions” on users’ behalf, which would be legally binding.

One early adopter, Peter Yang, noted that Instinct initially refused to delete his Gmail records when he asked. The team later addressed the issue by adding a tool in the settings to remove external data, he said.

Another user, Claire Vo, discovered that Instinct kept summarizing her inbox even after she disconnected its access. When she asked the bot about it, it confirmed that the emails were stored in plain text for future searches.

Many others have questioned the security model as well. One tester grew uneasy after seeing Instinct pull a sign-up code from their email to complete a task—in that case, booking a restaurant table via Resy. Alex Cohen, co-founder of Hello Patient, wrote that once he realized how easily Instinct could be phished, he deleted his account:

Katie Jacobs Stanton, founder of Moxxie Ventures, shared that Instinct broke her trust when it sent an email on her behalf without checking with her first. “We’re trading privacy and control for hyper-personalized AI tools (AI notetakers, personalized AI agents, etc), often without fully understanding the trade,” she posted on X, summing up the dilemma of personal AI agents. “The more powerful these agents become, the more trust matters. Every successful action earns a little more trust. One unauthorized action can reset that trust to zero.”

Michael Mignano, founder of Anchor (acquired by Spotify) and now a general partner at Union Square Ventures, noted that products like Instinct are poised to “change modern security norms for consumers.” He added that “people will increasingly hand over passwords to 3p [third-party] apps, unaware of how or what they are storing for them.”

Interest in Instinct and personal AI has surged since OpenClaw’s arrival—a personal assistant that gained popularity for its powerful features, eventually leading its founder to join OpenAI to work on next-gen personal agents. Another messaging-based assistant, Poke, also just exited to Cognition. Amid the criticism, Instinct’s team has stayed quiet on X, not responding to user concerns or complaints and keeping a low profile. (The bot itself mentions Luca Borletti, also formerly of Sierra, as involved with the company, though that hasn’t been confirmed.)

Requests for comment sent to the startup’s main email and to Shinn directly have not yet received a response.