Instinct’s powerful AI assistant is raising privacy and security concerns

Instinct is a privately tested AI assistant developed by a small team led by former Sierra research scientist Noah Shinn and operated by Spear Street Technology in San Francisco. The agent integrates with a range of personal applications and device sensors—email, messaging apps, calendar, audio, location, screen, and more—allowing users to issue commands via text or WhatsApp to perform tasks such as scheduling appointments, managing inboxes, booking travel, and handling purchases. While testers report that the system meets or exceeds their expectations, its current operation remains in stealth mode and is not yet available to the general public.

The service’s terms grant Instinct broad authority to enter into binding agreements, commitments, or transactions on behalf of users, and its privacy policy acknowledges a sub‑licensable, worldwide, perpetual, and irrevocable license to user data. Early adopters have noted issues such as the assistant’s initial inability to delete Gmail records upon request, a problem later addressed by adding a data‑deletion tool in settings. These capabilities raise questions about the trade‑offs between functional convenience and the exposure of personal information.

Why this matters

The combination of deep device‑level access, autonomous transactional authority, and a permissive data license creates a scenario where a single malfunction or policy change could result in unintended legal or financial obligations for users. While the company’s transparency about data usage is notable, the extent of required permissions outweighs the current convenience benefits, suggesting that robust user controls and independent audits are necessary before wider deployment.