Also inEspañol

What is Instinct AI? A teardown of the agent in your texts

Lives in your messaging apps rather than in a new interface.

What users and reporters say went wrong with Instinct, checked against this teardown: Is Instinct safe?

Instinct AI is a personal agent from Spear Street Technology (instinct.com), launched invite-only in August 2026, that you reach through WhatsApp, SMS or iMessage rather than through an app of its own. Most personal agents start by asking you to open something new. Instinct doesn't, and that one decision explains most of what's odd about the way it's built.

You send it an errand in WhatsApp, SMS or iMessage, it carries the work out on a machine of its own in the cloud, and it reports back in the same thread. What follows is what we found when we took that machine apart. For the same findings as one errand, step by step, see how Instinct AI works.

Identity and access. This is Instinct from Spear Street Technology at instinct.com, not the sales-coaching product at getinstinct.io or the Hugging Face organisation named Instinct-AI. Instinct's terms of service name the operator as Spear Street Technology, Inc., doing business as Instinct. TechCrunch reported that it launched as an invite-only service in August 2026.

Company history, dated sources. That same month, Yahoo Finance reported, citing The Wall Street Journal, a $250 million Series B co-led by Index Ventures and Benchmark at a $2.5 billion valuation. On 28 September it raised a $1 billion Series C at a $10 billion valuation; Reuters named the founder as Noah Shinn and listed Sequoia, Benchmark and Coatue as investors. Eesel's guide says Shinn describes himself as one of Sierra's first employees and is first author of Reflexion, a paper on language agents that correct themselves; he is also a co-author of Tau-bench, the agent benchmark Sierra published in 2024. The same TechCrunch piece describes a concierge feature that phones businesses for you, and Yahoo's report says you can reach it by phone call as well as by text. On 5 October, TechCrunch reported group chats for early access users: a shared Instinct joins a chat with friends, including friends who have no account. In The Verge's hands-on, access meant an invitation from a current user or approval from a waitlist, and Shinn said it is free for invite-only users.

The Information reported a compute shortage on 10 September. That does not establish when a particular waitlist applicant will gain access.

On your data, the privacy policy says it uses information "to evaluate, fine-tune, and train the AI models that power our products and technology". You can opt out in settings, though the policy keeps training on material flagged for safety review, and the terms exempt what you put in the credential vault. In September a user posted screenshots in which the agent appeared to describe someone else's document; Business Insider reported Shinn's answer that it was a hallucination, not a breach. We have no way to check either side of that from our account.

• The conversation happens in WhatsApp, SMS, iMessage or on a mail domain the product gives you. The web app is an admin panel, and on the account we examined its chat route was switched off.
• Capabilities arrive as a command line rather than a function list. Three different totals for that surface are all true, depending on who is counting.
• An action refuses to run until its manual has been read. That rule is enforced, which makes the documentation part of the prompt.
• Memory is three separate stores doing three different jobs, including a credential vault built to fill and never to reveal.
• A clock or an event can start it. You are not the only thing that wakes it up.

Why Instinct AI's web app isn't where the product lives

Your conversation happens in WhatsApp, or over SMS, or in iMessage, or at an address on a mail domain the product hands you. There is a web app. It's an admin panel. On the account we looked at, the chat route inside it was switched off at the feature-flag level and bounced you back to the workspace view, and the desktop build was gated the same way.

On the examined account, conversation stayed in the messaging channel while the web app handled administration. The approval card described below shows that this surface is not limited to plain text.

We did not establish an editable plan view in the examined Instinct account. What we observed was a veto on a proposed action: an approval card with three answers, approve, deny or dismiss, bound to the exact text it showed you, so a rewrite needs a fresh approval.

Instinct AI's tools: a command line where everyone else ships a function list

Most agents hand the model a list of functions with typed parameters. Instinct hands it a shell instead.

Every capability arrives as tools <namespace> <action>, one surface covering delegation, to-dos, mail, the messaging channels themselves, a cloud browser, an indexed data store you can run SQL against, and the alarm clock that wakes it up. A single grammar, extended by adding namespaces rather than by growing a schema blob.

Counting that surface is where it gets interesting, because three different numbers are all true.

The product's own help index reports 43 tool families and 571 actions. Our pass over the same index came back with 39 families and 569 actions. Once you add the ones that exist on live pages but aren't listed separately, we registered 577 distinct action names. Of those, 335 gave up a complete manual page. The other 242 each have a stated reason: an integration you haven't connected answers a help request with one status line and never reveals its usage, some actions are preloaded for a role rather than published, some return output that stops short. Nothing in that gap is unexplained. That isn't the same as saying all 577 are reachable by you.

We report all three figures rather than picking the flattering one. A site that tells you a product has "571 actions" without saying where that number came from is asking you to trust a number it did not check.

The manual is mandatory, and the model pays for it

Before an action runs for the first time, its help page has to be fetched. That's not a convention the model follows when it feels like it; it's enforced. Skip the read and the call fails, and the failure shoves the manual into the context anyway.

This is a good design, and it isn't free.

The help gate requires the model to consult documented arguments before acting. It targets invented parameters, but we did not measure whether it eliminates invalid calls or establish a validator that makes them impossible. Reading the manual is an observable requirement; reliability across repeated or unfamiliar calls remains a separate question.

On the debit side, the documentation is the prompt. A job that touches six unfamiliar actions pays for six manual reads before any work happens, and that budget comes out of the same context window the conversation lives in. It's a deliberate trade of tokens for intended reliability, and it's the sort of choice you only make once you've watched enough agents guess wrong.

Where Instinct AI actually does the work

Delegated tasks run in a Firecracker microVM from E2B, a sandbox provider. We confirmed that one directly.

The sandbox takes outbound connections and accepts no inbound logins, and browser work goes to a leased cloud instance rather than the Chrome on your desk, though that instance can use sign-ins you've saved. The examined route separates the cloud browser session from your local browser.

The main agent is a different story. It has a shell, subject to the same time limit and content filtering; it writes files and reads them back several turns later, so something durable is underneath it. We never captured anything that identifies the machine, so we're not going to tell you it's the same kind of sandbox. It might be. We don't know, and that distinction sits in the last row of our scorecard rather than being quietly rounded off.

How Instinct AI remembers: three stores, three different jobs

There's a git-tracked set of markdown files, which is the part people notice. There's a separate layer of indexed connector data, sitting behind a query interface rather than a chat box. And there's a credential vault built to fill and never to reveal: the agent can type your card number into a checkout form without being able to read it back to you or to anyone else, and passwords don't travel through the messaging channel at all.

That third store is the one worth dwelling on. A personal agent that can act on your behalf needs credentials. A personal agent that can read its own credentials back is one prompt injection away from handing them to a stranger. Splitting "can use" from "can see" is the correct answer to that problem. Of the four products we opened, Instinct is the one where we observed it as a separate store rather than as a policy. Meta describes a similar stand-in arrangement for Muse, which we have not tested.

Version control on the memory files buys something too. Old information doesn't vanish when a fact is corrected; it stays in the history, retrievable if somebody goes looking. That cuts both ways, and the product is the one deciding which way.

Worth saying plainly: we're not the only ones who went looking. On 20 September Dhravya Shah, the founder of supermemory, published an independent teardown of the memory layer, reached entirely by probing the iMessage surface, and landed on the same shape from the outside: markdown under version control, keyword lookup rather than vector search, reconciliation running roughly once a day.

Two teams poking at the same product from different angles and agreeing is worth more than either of us saying it alone. It's also a reminder that none of this requires special access. The examined surface reveals useful behaviour, but account flags and unavailable integrations limit what another user can reproduce.

It wakes itself up

Instinct doesn't only answer. A clock can start it, and so can an event on your mail, your calendar, your documents or your location. The platform runs its own safety check before a wake turns into action.

That last clause is the sort of detail nobody puts on a landing page and everybody should ask about. An agent that can be triggered by an incoming email, in a product where the agent also has an email address, is an agent whose trigger surface is reachable by strangers. A second check between "something happened" and "act on it" is the thing standing between that design and a very bad afternoon.

What we couldn't establish

• The body of the main instruction set. It runs to 27 sections; only their headings ever surfaced.
• Which host the main agent runs on. See above.
• The production model id. Nothing on the client names it.
• The schema behind the control plane. Introspection is turned off.
• The desktop app. An account flag keeps it shut, so we never saw it run.
• Four named policy sections. We found pointers to them and never their text.

The product this one gets compared with most often is Meta's, and the comparison usually counts features. If you want that kind of table, Every's side-by-side of personal agents covers channels, tools, privacy, memory and pricing. Muse vs Instinct puts the two runtimes side by side on the axes above instead.

The recorded runs include concrete errands: cancelling a subscription, arranging a family dinner, and attempting a restaurant booking. Their task states show what happened in each attempt; the aggregate completion figure is a separate measurement, not a claim that every kind of errand works equally well.

FAQ

What is Instinct AI? A personal agent that lives in your existing messaging apps rather than in a new interface. You talk to it in WhatsApp, SMS or iMessage, or by emailing an address it gives you, and it runs tasks on your behalf in a cloud sandbox.

Does Instinct AI have a web app? There is one, but it functions as an admin panel. On the account we examined the chat route inside it was disabled by a feature flag and redirected back to the workspace, and the desktop build was gated the same way.

How many tools does Instinct AI have? Three answers, all honest. Its own help index reports 43 families and 571 actions. Our enumeration of that index found 39 families and 569 actions. Counting names that exist on live pages without a separate index entry gives 577. Only 335 have a full manual page, and the rest each have a stated reason.

Where does Instinct AI run its tasks? Delegated tasks run in a Firecracker microVM from E2B, outbound-only, with browser work handed to a leased cloud browser rather than your own. Where the main agent itself runs is something we could not pin down.

Can Instinct AI read my saved passwords? Not according to how the vault is built. It's designed to fill credentials into a form without being able to reveal them, and passwords don't travel through the messaging channel. Of the products we opened, it is the only one where we saw that separation built as its own store.

Can Instinct access my bank account? What the banks say: CNBC's 13 October report on JPMorgan Chase names Instinct, and a JPMorgan spokeswoman told CNBC the bank does not let third parties log in with customers' banking credentials, while it supports customer-authorised data sharing through open banking providers, which CNBC reads as read-only access to data such as balances; Citi said much the same, and Schwab said it blocks agents that log in for clients (what each said). What we saw: Instinct's credential vault is built to fill a password or card number into a form without being able to read it back, and its cloud browser can use sign-ins you have saved. We found no Instinct page describing a bank connection and did not connect one, so we have not seen it sign in to a bank. A bank login saved in the vault would mean the agent signing in as you, the route those banks say they block. In our exam, asked to log in to an unfamiliar page, our replica of Instinct's runtime refused and said passwords should not pass through the chat.

Can Instinct AI act without me asking? Yes. Routines can fire on a clock or on an event in your mail, calendar, documents or location, with a platform-side safety check before a wake turns into an action.

Where Instinct AI lands on the personal agent scorecard

Of the four products we opened, Instinct moved furthest from the chat window, and it backed that bet with careful plumbing. We observed action approvals but did not establish an editable plan view on this account. It keeps your veto with an approval card bound to the exact text you saw, and it adds a help gate intended to reduce invented calls and a vault that stops it reading your secrets.

The scorecard puts it beside Pine, Muse and Town on the same six axes, including the one nobody else publishes: what we could not establish.

Instinct AI compared with the others we opened

Side by side on the same axes, against Muse, Town and Pine. We only build these for pairs we have taken apart ourselves, because a comparison with marketing on one side is the thing this site exists to replace.

Other pages on Instinct

• How Instinct AI worksHow does Instinct AI work? One errand traced from trigger to reply: what wakes it, how it picks tools, where it runs, what it remembers and when it asks.
• Instinct AI reviewInstinct AI review roundup: what reporters who used it got done and got wrong, how that maps onto our teardown, and our exam figures with intervals.
• Is Instinct safe?Is Instinct AI safe? Every incident users and reporters have described, from unchecked emails to login codes read from Gmail, checked against our teardown.

Errands we describe Instinct AI against

Each errand page says what the job demands and what Instinct brings to it, next to the other products. They describe; they don't score this product on that errand.

• Booking a table
• Getting a subscription cancelled
• Disputing a charge
• Rearranging a family week
• Claiming for a delayed flight
• Watching something live
• Organising work files

What Instinct AI costs

No subscription amount was found on Instinct’s public homepage or in section 4 of its terms when checked on 12 October 2026. The terms allow paid services in US dollars and changes to fees, and make payments non-refundable except where law requires otherwise. They specify no price.

That is worth stating plainly rather than leaving the section empty: a product with no published price is not one we failed to check.

Read on 2026-10-12: Instinct terms of service, section 4, Paid services (last revised 26 August 2026); Instinct public homepage; no price exposed in the fetched view.

Instinct AI, axis by axis

Instinct AI: where it runs

Server orchestration with work running in a sandbox. Browser tasks use a leased cloud browser, not the Chrome on your desk.

Instinct AI: how tools are exposed

A command-line surface rather than a function list: 43 families and 571 actions by the product's own count, and three different totals depending on who is counting. An action refuses to run until its own help text has been read, which makes the manual part of the prompt.

Instinct AI: where memory lives

Three stores that do different jobs: a git-tracked set of markdown memory files, an indexed layer of connector data it can query, and a fill-only vault for secrets.

Instinct AI: what you get to approve

An approval card with three answers rather than two: approve, deny, or dismiss. It carries the plan and names which device will run it. Approval binds to the exact text shown, not to the request that produced it, so a rewrite needs a new approval. Its own rules forbid an unseen assumption from riding along with an irreversible send, and it will produce a receipt on request: what it read, what it sent, what it did not touch. Deletion has a documented surface covering storage, training, location and desktop indexing.

Instinct AI: how you reach it

Messaging first. WhatsApp, SMS and iMessage are the default surface, plus an address on its own mail domain. The web app is mostly an admin panel.

Instinct AI: what we could not establish

The body of the main instruction set (only its section headings surfaced), which host the main agent runs on, the production model id, and four named policy sections we found pointers to but never text for.

The other teardowns

• PinePhones companies on your behalf about bills, refunds and cancellations.
• MuseMeta's personal agent, with a Linux machine of your own behind it.
• TownWeb and native Mac, with the broadest native reach into your Mac of the four.

Or read how we score, and why the existing agent benchmarks don't answer this.