Loading today’s stories
Product1 distinct publisher3 min readUpdated
The assistant connects to email, calendar, screen and location. Testers found it still reading an inbox after access was disconnected, and the company has not replied.
The Product Desk · Product desk
Compiled by The Product DeskSomething wrong?How this is made
Follow any of these and your For You feed starts watching them — no settings page required.
A capability impresses until the model changes. A contract does not expire on that schedule. The version of Instinct's terms circulating in tester screenshots grants a "perpetual and irrevocable" license to access, use, host, cache, store, reproduce, transmit, display, publish, distribute and modify user materials, including for training its models [5]. That is eleven separate permissions in one sentence [19], and the two adjectives in front of them are not the kind a settings toggle can retract.
Set that against what testers actually observed. Claire Vo found Instinct still summarising her inbox after she disconnected its access, and the bot told her the emails were stored in plain text for later searches [9]. Peter Yang asked it to delete his Gmail records and it would not, until the team shipped a tool in settings for deleting external data [8]. Those two reports describe one architecture from opposite ends: connection state and stored state are separate things, and until Yang complained only the first had a control surface. A revoked integration is not a deletion, and the terms do not oblige it to be.
The clause that deserves more attention than the storage question is the one allowing Instinct to enter "agreements, commitments, or transactions" on a user's behalf, binding them [7]. Moxxie Ventures founder Katie Jacobs Stanton reported the assistant sending an email for her without checking first, and wrote that one unauthorised action resets trust to zero [12]. An email is the cheap version of that failure. A binding commitment is the expensive one, and the terms already contemplate it.
Then there is the code. One tester watched Instinct pull a sign-up code out of their inbox to finish booking a Resy table [10]. Read that as an architecture rather than a party trick: an agent with inbox read access and the ability to act on what it finds there is a path around any login flow that relies on a code sent by mail. Hello Patient co-founder Alex Cohen deleted his account after seeing how easily the thing could be phished [11]. Whoever gets the agent to act gets whatever the agent can reach, and the source describes five separate control failures reported by testers, four of them from named individuals [18].
Union Square Ventures GP Michael Mignano expects products like this to change consumer security norms, with people handing passwords to third-party apps without knowing what is stored [13]. That is the mechanism worth naming: the terms are where the norm gets written, and nobody reads them at the speed a private beta ships. Instinct is operated by Spear Street Technology, per its terms and California business filings, is in stealth per PitchBook, and its team has not answered any of the complaints on X [2][16]. Testers describe the product as feeling "like magic" [14]. The document says perpetual.
Ranked by verification strength, evidence, and original report placement.
Screenshots of the company's Terms of Service circulated by several people grant Instinct a broad "perpetual and irrevocable" license to "access, use, host, cache, store, reproduce, transmit, display, publish, distribute, and modify" any of the user's materials, including for training its AI models.
Instinct is an AI personal assistant still in private access as of the report.
Instinct was created by a small team led by former Sierra research scientist Noah Shinn, is San Francisco-based, is operated by Spear Street Technology per its terms and California business filings, and is operating in stealth per PitchBook.
The agent works by connecting to a user's applications and devices, including email, messaging apps, calendar, and the device's audio, location and screen.
Users can text or call the agent via text message or WhatsApp and ask it to book appointments and reservations, schedule a ride to the airport, clean up an inbox, handle shopping and find cheap flights.
The terms detail how Instinct can receive information from users' devices, including screen captures, cursor movements and keyboard inputs.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Single-outlet reporting built on tester posts and circulated screenshots
One publisher supplies the entire cluster. The strongest documentary element -- the license and agent-authority clauses -- reaches readers through screenshots circulated by third parties rather than a verified terms document or company confirmation, and the company answered neither public criticism nor comment requests. The tester incidents are specific and mostly named, which lifts credibility above rumour, but nothing has been independently reproduced or audited.
Private access with a visible tester cohort and closed rounds, no scale disclosed
Adoption evidence is real but narrow: a private access cohort of identifiable early users connecting live email, calendar and device data, a shipped fix (external-data deletion tool) in response to tester feedback, at least one account deletion, and reported closed rounds from two venture firms. No user counts, waitlist size, retention or revenue figures are available, and the product is not generally available.
Superlative tester framing outruns verified capability and safety evidence
The enthusiasm side of the story ('like magic', most exciting launch since OpenClaw) rests on unverified anecdote from a small private cohort, and the alarm side rests on screenshots and self-reported incidents rather than audits. The report itself hedges by noting the concerns have not scaled beyond private testing, which limits the overstatement, but both the capability praise and the sweeping norm-change forecast exceed what the supplied evidence establishes.
Attention-aligned commentators and a stealth company benefiting from buzz
Most primary material comes from X posts by founders and venture investors whose visibility and deal flow benefit from being early voices on a hot launch, including a GP whose firm invests in this category. The stealth company gains distribution from the buzz while declining to answer, and the publisher has a traffic interest in a viral privacy controversy. These incentives do not negate the specific incident reports but they shape which details surfaced.
Specific incidents, thin verification, unresolved company account
Confidence is moderate-low: the incident reports are concrete and largely named, and the quoted contract language is unusual enough to be checkable, but everything sits in one outlet with no company confirmation, no legal review of the clauses, and no independent security testing. Facts about the team, product surface and market context are the most reliable elements; the scope and persistence of the data-retention behaviour is the least settled.
build
OpenClaw makes the channel the architecture, and the reasoning loop a lodger1 distinct publisher
build
Nous wants you to own the harness, which means you own the patching too1 distinct publisher
product
ChatGPT Work's real ask is your Slack, and somebody has to say yes on everyone's behalf1 distinct publisher
product
Meta owns the models and the data centres, and still pays Microsoft to rent someone else's1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 24, 2026