Instinct AI teardown: the agent inside your messages

Lives in your messaging apps rather than in a new interface.

Every other personal agent starts by asking you to open something new. Instinct AI doesn't, and that one decision explains most of what's odd about the way it's built.

• The conversation happens in WhatsApp, SMS, iMessage or on a mail domain the product gives you. The web app is an admin panel, and on the account we examined its chat route was switched off.
• Capabilities arrive as a command line rather than a function list. Three different totals for that surface are all true, depending on who is counting.
• An action refuses to run until its manual has been read. That rule is enforced, which makes the documentation part of the prompt and part of the bill.
• Memory is three separate stores doing three different jobs, including a credential vault built to fill and never to reveal.
• A clock or an event can start it. You are not the only thing that wakes it up.

The web app isn't where the product lives

Your conversation happens in WhatsApp, or over SMS, or in iMessage, or at an address on a mail domain the product hands you. There is a web app. It's an admin panel. On the account we looked at, the chat route inside it was switched off at the feature-flag level and bounced you back to the workspace view, and the desktop build was gated the same way.

So there's no window to open, no new habit to build, and no place for you to go looking at what the agent was told. The flip side is that Instinct has to work in a medium with no buttons, no side panel and no way to show you a half-finished thought. Everything it wants to tell you has to survive as a text message.

That constraint is doing more design work than it looks like. A web agent can show you a plan, let you edit step four, and run the rest. An agent in a message thread has to decide, act, and then tell you in prose what it did. The interface removes the confirmation step that every other product on this bench leans on.

A command line where everyone else ships a function list

Most agents hand the model a list of functions with typed parameters. Instinct hands it a shell instead.

Every capability arrives as tools <namespace> <action>, one surface covering delegation, to-dos, mail, the messaging channels themselves, a cloud browser, an indexed data store you can run SQL against, and the alarm clock that wakes it up. A single grammar, extended by adding namespaces rather than by growing a schema blob.

Counting that surface is where it gets interesting, because three different numbers are all true.

The product's own help index reports 43 tool families and 571 actions. Our pass over the same index came back with 39 families and 569 actions. Once you add the ones that exist on live pages but aren't listed separately, we registered 577 distinct action names. Of those, 335 gave up a complete manual page. The other 242 each have a stated reason: an integration you haven't connected answers a help request with one status line and never reveals its usage, some actions are preloaded for a role rather than published, some return output that stops short. Nothing in that gap is unexplained. That isn't the same as saying all 577 are reachable by you.

We report all three figures rather than picking the flattering one. A site that tells you a product has "571 actions" without saying where that number came from is asking you to trust a number it did not check.

The manual is mandatory, and the model pays for it

Before an action runs for the first time, its help page has to be fetched. That's not a convention the model follows when it feels like it; it's enforced. Skip the read and the call fails, and the failure shoves the manual into the context anyway.

This is a good design, and it isn't free.

On the credit side, the model can't invent a parameter that doesn't exist, and a rarely used action behaves the same on its first call as on its hundredth. Hallucinated arguments are one of the most common ways agents fail in the wild, and this rules the whole class out by construction.

On the debit side, the documentation is the prompt. A job that touches six unfamiliar actions pays for six manual reads before any work happens, and that budget comes out of the same context window the conversation lives in. It's a deliberate trade of tokens for reliability, and it's the sort of choice you only make once you've watched enough agents guess wrong.

Where the work actually happens

Delegated tasks run in a Firecracker microVM from E2B. We confirmed that one directly.

The sandbox takes outbound connections and accepts no inbound logins, and browser work goes to a leased cloud instance rather than the Chrome on your desk, though that instance can use sign-ins you've saved. Leasing a browser instead of driving yours is the safer arrangement for you and the more expensive one for them.

The main agent is a different story. It has a shell, subject to the same time limit and content filtering; it writes files and reads them back several turns later, so something durable is underneath it. We never captured anything that identifies the machine, so we're not going to tell you it's the same kind of sandbox. It might be. We don't know, and that distinction sits in the last row of our scorecard rather than being quietly rounded off.

Memory: three stores, three different jobs

There's a git-tracked set of markdown files, which is the part people notice. There's a separate layer of indexed connector data, sitting behind a query interface rather than a chat box. And there's a credential vault built to fill and never to reveal: the agent can type your card number into a checkout form without being able to read it back to you or to anyone else, and passwords don't travel through the messaging channel at all.

That third store is the one worth dwelling on. A personal agent that can act on your behalf needs credentials. A personal agent that can read its own credentials back is one prompt injection away from handing them to a stranger. Splitting "can use" from "can see" is the correct answer to that problem, and Instinct is the only product on this bench that implements it as a separate store rather than as a policy.

Version control on the memory files buys something too. Old information doesn't vanish when a fact is corrected; it stays in the history, retrievable if somebody goes looking. That cuts both ways, and the product is the one deciding which way.

Worth saying plainly: we're not the only ones who went looking. On 20 September the founder of supermemory published an independent teardown of the memory layer, reached entirely by probing the iMessage surface, and landed on the same shape from the outside: markdown under version control, keyword lookup rather than vector search, reconciliation running roughly once a day. That post cleared 280,000 views.

Two teams poking at the same product from different angles and agreeing is worth more than either of us saying it alone. It's also a reminder that none of this requires special access. The surface is the product, and anybody patient enough can read it.

It wakes itself up

Instinct doesn't only answer. A clock can start it, and so can an event on your mail, your calendar, your documents or your location. The platform runs its own safety check before a wake turns into action.

That last clause is the sort of detail nobody puts on a landing page and everybody should ask about. An agent that can be triggered by an incoming email, in a product where the agent also has an email address, is an agent whose trigger surface is reachable by strangers. A second check between "something happened" and "act on it" is the thing standing between that design and a very bad afternoon.

What we couldn't establish

[TODO 保留本节，上线前逐条复核]

• The body of the main instruction set. It runs to 27 sections; only their headings ever surfaced.
• Which host the main agent runs on. See above.
• The production model id. Nothing on the client names it.
• The schema behind the control plane. Introspection is turned off.
• The desktop app. An account flag keeps it shut, so we never saw it run.

FAQ

What is Instinct AI? A personal agent that lives in your existing messaging apps rather than in a new interface. You talk to it in WhatsApp, SMS or iMessage, or by emailing an address it gives you, and it runs tasks on your behalf in a cloud sandbox.

Does Instinct AI have a web app? There is one, but it functions as an admin panel. On the account we examined the chat route inside it was disabled by a feature flag and redirected back to the workspace, and the desktop build was gated the same way.

How many tools does Instinct AI have? Three answers, all honest. Its own help index reports 43 families and 571 actions. Our enumeration of that index found 39 families and 569 actions. Counting names that exist on live pages without a separate index entry gives 577. Only 335 have a full manual page, and the rest each have a stated reason.

Where does Instinct AI run its tasks? Delegated tasks run in a Firecracker microVM from E2B, outbound-only, with browser work handed to a leased cloud browser rather than your own. Where the main agent itself runs is something we could not pin down.

Can Instinct AI read my saved passwords? Not according to how the vault is built. It's designed to fill credentials into a form without being able to reveal them, and passwords don't travel through the messaging channel. That separation is the strongest security design decision on this bench.

Can Instinct AI act without me asking? Yes. Routines can fire on a clock or on an event in your mail, calendar, documents or location, with a platform-side safety check before a wake turns into an action.

Pricing

[TODO 数据从 data/pricing.json 读，带 as-of 日期渲染。上线前核一次。]

Where Instinct AI lands on the personal agent scorecard

Instinct made the boldest interface bet on this bench and backed it with the most careful plumbing. Living in a message thread costs it the confirmation step everyone else relies on, and it pays that back with a help gate that stops the model inventing calls and a vault that stops it reading your secrets.

The scorecard puts it beside Pine, Muse and Town on the same five axes, including the one nobody else publishes: what we could not establish.

The five axes

Where it runs

Server orchestration with work running in a sandbox. Browser tasks use a leased cloud browser, not the Chrome on your desk.

How tools are exposed

A command-line surface rather than a function list: 43 families and 571 actions by the product's own count, and three different totals depending on who is counting. An action refuses to run until its own help text has been read, which makes the manual part of the prompt.

Where memory lives

Three stores that do different jobs: a read-only markdown set, an observation log, and a fill-only vault for secrets.

How you reach it

Messaging first. WhatsApp, SMS and iMessage are the default surface, plus an address on its own mail domain. The web app is mostly an admin panel.

What we could not establish

The body of the main instruction set (only its section headings surfaced), which host the main agent runs on, the production model id, and four named policy sections we found pointers to but never text for.

The other three

• PinePhones companies on your behalf about bills, refunds and cancellations.
• MuseMeta's personal agent, with a Linux machine of your own behind it.
• TownWeb and native Mac, with a real foothold on the machine itself.

Or read how we score, and why the existing agent benchmarks don't answer this.