---
title: "How does Instinct AI work? From trigger to action"
description: "How does Instinct AI work? One errand traced from trigger to reply: what wakes it, how it picks tools, where it runs, what it remembers and when it asks."
url: https://personalagentbench.com/how-instinct-ai-works/
last_updated: 2026-10-20
---

# How does Instinct AI work? One errand, from trigger to action

How does Instinct AI work? You send it an errand in WhatsApp, SMS or iMessage, or something on your clock, mail or calendar wakes it, and it works the job out through a command line whose manual it has to read before each new action. The work runs on machines in the cloud, it remembers through three separate stores, and it stops to show you an approval card before it acts on your behalf.

Instinct is a personal agent from Spear Street Technology (instinct.com), launched invite-only in August 2026; [Reuters](https://www.thestar.com.my/tech/tech-news/2026/09/28/ai-agent-firm-instinct-raises-1-billion-in-latest-funding-round) names the founder as Noah Shinn. In [The Verge's hands-on](https://www.theverge.com/tech/1008254/instinct-agent-ai-hands-on-muse-dots), access meant an invitation or a place off the waitlist, and Shinn said it is free for invite-only users. We have [taken it apart](https://personalagentbench.com/agents/instinct/). This page doesn't repeat that teardown. It follows one errand through the product, step by step, and for each step says what we found, how sure we are, and where the evidence sits.

- **The trigger** can be you, a clock, or an event on your mail, calendar, documents or location. A platform-side safety check runs before a wake turns into action.
- **The decision** happens through one command-line grammar, and an action refuses to run until its help page has been read.
- **The work** runs off your devices: delegated tasks in a sandbox, browser work in a leased cloud browser.
- **The memory** is three stores, and one of them, the credential vault, can fill a form but never show you what it filled.
- **The approval** is a card with three answers, bound to the exact text it showed you.

## How Instinct AI works, traced through one errand

To keep the steps concrete, picture an ordinary errand: you text Instinct asking it to cancel a subscription you no longer use. That is an illustration built from parts we observed, not a transcript. Separately, our exam ran our rebuilt copy of Instinct's runtime on a [subscription cancellation](https://personalagentbench.com/runs/life-admin/), a family dinner and a restaurant booking in a simulated world. Those are recorded runs, and this walkthrough is not drawn from them.

The errand passes through six stages. Something starts it. The agent works out which actions it needs. Those actions run somewhere. The agent draws on what it remembers, including your saved sign-ins. It asks you before anything you can't take back. Then it tells you what it did, in the same thread you started in.

Each of those stages maps to a part of our teardown, and they aren't equally well lit. We confirmed some directly, observed others on the account we examined, and have only press reports for a few. The table further down keeps those apart.

## Step 1: what starts Instinct AI

The obvious trigger is you. Instinct has no app of its own to open. You reach it [through WhatsApp, SMS or iMessage](https://personalagentbench.com/agents/instinct/#why-instinct-ai-s-web-app-isn-t-where-the-product-lives), or by writing to an address on a mail domain the product gives you. There is a web app, but it's an admin panel. On the account we examined, the chat route inside it was switched off for our account and bounced you back to the workspace view, and the desktop build was gated the same way.

So your errand starts as a text message. That's the whole front door.

It isn't the only one, though. Instinct [wakes itself up](https://personalagentbench.com/agents/instinct/#it-wakes-itself-up). A clock can start it, and so can an event on your mail, your calendar, your documents or your location. If your subscription sends a renewal reminder to a connected inbox, that email is a possible trigger too, with no message from you at all.

That's where the platform's own safety check matters. Before a wake turns into action, the platform runs a check. An agent that has its own email address, and can be woken by incoming email, has a trigger that strangers can reach. The check sits between "something happened" and "act on it". We observed that it exists. We did not test how well it holds up against a hostile message, and none of the [incidents reported so far](https://personalagentbench.com/is-instinct-safe/#instinct-ai-incidents-reported-so-far) involve a stranger triggering it.

Two newer front doors we have not examined. TechCrunch [reported group chats](https://techcrunch.com/2026/10/05/instinct-brings-its-ai-agent-to-group-chats-even-for-friends-without-an-account/) for early access users on 5 October, where a shared Instinct joins a chat with friends, and [a concierge feature](https://techcrunch.com/2026/09/28/viral-ai-agent-instinct-raises-1b-series-c-at-a-10b-valuation/) that phones businesses for you. Both arrived as reports, not as things we watched run.

## Step 2: how Instinct decides what to do

Once the errand is in, the agent has to turn "cancel this subscription" into actions. Most agents do that by picking from a list of functions with typed parameters. Instinct [hands its model a shell instead](https://personalagentbench.com/agents/instinct/#instinct-ai-s-tools-a-command-line-where-everyone-else-ships-a-function-list).

Every capability arrives as `tools <namespace> <action>`. One grammar covers delegation, to-dos, mail, the messaging channels themselves, a cloud browser, an indexed data store you can run SQL against, and the alarm clock that wakes it up. For our errand, the agent might search your mail for the provider, open the cancellation page in the browser, and set a to-do to check the confirmation arrived.

How big is that surface? By its own help index, 43 tool families and 571 actions. Our own count differs, and [the teardown explains why](https://personalagentbench.com/agents/instinct/#instinct-ai-s-tools-a-command-line-where-everyone-else-ships-a-function-list).

Then comes the rule that shapes everything else. [The manual is mandatory](https://personalagentbench.com/agents/instinct/#the-manual-is-mandatory-and-the-model-pays-for-it). Before an action runs for the first time, its help page has to be fetched. Skip the read and the call fails, and the failure pushes the manual into the context anyway. The point is to make the model consult the documented arguments rather than invent them.

It isn't free. An errand that touches six unfamiliar actions pays for six manual reads before any work happens, out of the same context window the conversation lives in. And we didn't measure whether the rule actually removes invalid calls. What we can say is that the requirement exists and is enforced.

## Step 3: where Instinct AI does the work

Your errand doesn't run on your phone. [Delegated tasks run](https://personalagentbench.com/agents/instinct/#where-instinct-ai-actually-does-the-work) in a Firecracker microVM from [E2B](https://e2b.dev), a sandbox provider, and we confirmed that one directly. The sandbox makes outbound connections and accepts no inbound logins.

Browser work, like opening the provider's cancellation page, goes to a leased cloud browser rather than the Chrome on your desk. That cloud browser can use sign-ins you've saved. One side effect is worth knowing: a sign-in from a cloud browser comes from the cloud provider's network, so a site's security system may see an unfamiliar location. That fits [one reported incident](https://personalagentbench.com/is-instinct-safe/#instinct-iran-2fa), where a sign-in to a user's phone carrier set off a two-factor prompt labelled as coming from Iran. We can't tell whether that one was harmless. What this looks like from the website's side is on [is your website agent ready?](https://personalagentbench.com/agent-ready-website/)

The main agent, the part reading your texts and deciding what to delegate, is less clear. It has a shell, it writes files and reads them back several turns later, so something durable is underneath it. We never captured anything that identifies that machine. It might be the same kind of sandbox. We don't know, and it's on our [list of unknowns](https://personalagentbench.com/agents/instinct/#unknown).

## Step 4: what Instinct AI remembers, and the vault it can't read

To cancel a subscription the agent needs to know which one, which account it sits under, and how to sign in. That's memory, and Instinct [splits memory into three stores](https://personalagentbench.com/agents/instinct/#how-instinct-ai-remembers-three-stores-three-different-jobs) that do different jobs.

The first is a git-tracked set of markdown files. This is what it knows about you. Because it's under version control, a corrected fact doesn't vanish; it stays in the history. An [independent teardown by Dhravya Shah](https://x.com/DhravyaShah/status/2101745550752428340), reached entirely through the iMessage surface, landed on the same shape from the outside: markdown under version control, keyword lookup rather than vector search, and reconciliation roughly once a day.

The second is an indexed layer of data from the accounts you connect, sitting behind a query interface. This is how the agent would find the subscription's billing emails in your inbox. It's also why connecting Gmail gives the agent the whole mailbox, not just the message you have in mind. One user [received an inbox summary](https://personalagentbench.com/is-instinct-safe/#instinct-disconnect-summary) hours after disconnecting Google. A searchable copy is what that layer is; whether disconnecting empties it, we didn't test.

The third is the credential vault, built to fill and never to reveal. The agent can type your password or card number into a form without being able to read it back to you or anyone else, and passwords don't travel through the messaging channel at all. Of the four products we opened, Instinct is the one where we observed that separation built as its own store rather than as a policy. No reported incident we found involves the vault.

On training, Instinct's [privacy policy](https://instinct.com/privacy-policy) says it uses your information to train its models unless you opt out in settings. The opt-out doesn't cover material flagged for safety review, and the terms exempt what you put in the vault.

## Step 5: where Instinct asks you first

Before an action like clicking "cancel", the design we saw shows an [approval card](https://personalagentbench.com/agents/instinct/#control). It has three answers rather than two: approve, deny or dismiss. It carries the plan and names which device will run it.

The important detail is what the approval attaches to. It binds to the exact text shown, not to the request that produced it, so if the agent rewrites the message after you approve, it needs a fresh approval. Its own rules forbid an unseen assumption from riding along with an irreversible send.

Two limits are worth stating. First, we didn't establish an editable plan view on the account we examined. What we saw was a veto over a proposed action, not a plan you can rearrange. Second, approval cards cover actions, and reading isn't one. In [one report](https://personalagentbench.com/is-instinct-safe/#instinct-login-codes), the agent found a one-time login code in a connected Gmail inbox and used it without asking. In the design we saw, the read itself wouldn't prompt a card. The sign-in that followed is where an approval would have been reasonable to expect.

Another report describes [an email sent without checking first](https://personalagentbench.com/is-instinct-safe/#instinct-unchecked-send), in August. We can't tell whether the card existed in its current form then, or whether that send fell outside it.

## Step 6: how Instinct AI reports back

The answer comes back in the thread you started in. There's no dashboard to check and no separate window.

If you want more than "done", ask for a receipt. Instinct's rules say it will produce one on request: what it read, what it sent and what it didn't touch. After any errand that went into your accounts, that's the question worth asking, because the login-code report also showed the agent first giving the wrong account of how it got in.

There's also a documented surface for deletion afterwards, covering storage, training, location and desktop indexing. We didn't test whether it removes connector data.

How often does the whole chain end in a finished errand? On our [exam results](https://personalagentbench.com/results/), Instinct's runtime, as we rebuilt it, completed 43% of scored tasks (95% interval 36 to 50%; 159 scored tasks) as of 22 September 2026. On a separate, older batch where every product answered the same 114 tasks, it completed 52% (95% interval 45 to 61%). In the headline October batch, run on 11 October 2026, it completed 6 of 15 scored attempts, 40% (95% interval 20 to 64%). Those figures describe our rebuilt copy of its runtime using the exam model, not the consumer product end to end, the batches are never added together, and neither is a ranking.

## Each step, what we found, and how sure we are

| Step | What we found | How sure we are |
| --- | --- | --- |
| Trigger: you | WhatsApp, SMS, iMessage and an address on its own mail domain; the web app is an admin panel | Observed on our account |
| Trigger: clock or event | Mail, calendar, documents or location can wake it; a platform check runs first | Observed that it exists; not tested against hostile input |
| Group chats, phone calls | Reported by TechCrunch | Press report; not examined |
| Deciding | One `tools <namespace> <action>` grammar; 43 families and 571 actions by its own count | Its count; ours is 39 and 569, with 577 names in all |
| Manual rule | An action fails until its help page is read | Observed and enforced; effect on errors not measured |
| Delegated work | Firecracker microVM from E2B, outbound only | Confirmed directly |
| Browser work | Leased cloud browser that can use saved sign-ins | Observed on our account |
| Main agent's host | Has a shell and durable files | Not established |
| Memory | Git-tracked markdown, indexed connector data, fill-only vault | Observed; the markdown memory files matched by an independent teardown |
| Approval | Approve, deny or dismiss, bound to the exact text shown | Observed; no editable plan view established |
| Report back | Reply in the same thread; receipt on request | Receipt is in its rules; we did not audit one |

## What we could not establish about how Instinct AI works

Every step above has an edge where our view stops. The teardown keeps the full [list of what we couldn't establish](https://personalagentbench.com/agents/instinct/#what-we-couldn-t-establish), and these are the gaps that matter most for understanding the mechanics:

- **The main instruction set.** It runs to 27 sections, and only their headings ever surfaced. So we know the shape of what tells the agent how to behave, not the words.
- **Which host the main agent runs on.** Delegated work is confirmed; the agent deciding what to delegate isn't.

The production model, the admin backend's structure, the desktop app and four named policy sections are also on that list.

Two newer features, group chats and the phone concierge, sit outside all of this: we know them only from press reports. If you want to compare how Instinct's steps differ from another product's, [Muse vs Instinct](https://personalagentbench.com/muse-vs-instinct/), [Instinct vs Town](https://personalagentbench.com/instinct-vs-town/) and [Pine vs Instinct](https://personalagentbench.com/pine-vs-instinct/) lay the same parts side by side.

## FAQ

**How does Instinct AI work?** You text it in WhatsApp, SMS or iMessage, or a clock or event wakes it. It works through a command line whose manuals it must read before each new action, runs the work in a cloud sandbox and a leased cloud browser, and shows an approval card before it acts.

**What does Instinct AI do on its own, without being asked?** It can be woken by a clock or by an event on your mail, calendar, documents or location. A platform-side safety check runs before a wake turns into action. We did not test how that check handles a hostile message.

**Does Instinct AI run on my phone or computer?** Not on the account we examined. Delegated work runs in a Firecracker microVM from E2B, and browser work goes to a leased cloud browser. A desktop build exists but was switched off by an account flag, so we never saw it run.

**How does Instinct AI remember things?** Through three stores: git-tracked markdown files, an indexed layer of data from connected accounts, and a credential vault that can fill passwords and card numbers but cannot read them back.

**Does Instinct AI ask before it does something?** For actions, yes. An approval card offers approve, deny or dismiss and binds to the exact text shown. Reading from a connected account isn't treated as an action, so reads don't prompt a card.

**How do I use Instinct AI?**

1. Get access. In [The Verge's hands-on](https://www.theverge.com/tech/1008254/instinct-agent-ai-hands-on-muse-dots), that meant an invitation from a current user or a place off the waitlist.
2. Message it in WhatsApp, SMS or iMessage with the errand. The web app is for administration, not conversation.
3. Connect only the accounts the errand needs, answer the approval cards it shows, and ask for a receipt afterwards.

## More on Instinct

- [**Instinct teardown**](https://personalagentbench.com/agents/instinct/)
- [**Is Instinct safe?**Is Instinct AI safe? Every incident users and reporters have described, from unchecked emails to login codes read from Gmail, checked against our teardown.](https://personalagentbench.com/is-instinct-safe/)

---

Published by Personal Agent Bench (https://personalagentbench.com), run by the Zentor team. Zentor builds agent software of its own, so its products are not on the scorecard and will not be added.