Is Instinct AI safe? What users reported, and what our teardown shows

Is Instinct AI safe? It depends on what you connect to it, and the record so far says that matters more than anything in the marketing. Since Instinct opened to invited users in August 2026, reporters and early users have described it sending an email nobody checked, reading one-time login codes out of a connected inbox, keeping a searchable copy of mail after an account was disconnected, and going silent mid-errand. We have taken Instinct apart ourselves. This page lists each incident that traces back to a named, dated report, and says for each one whether it fits what we found inside the product, falls in a layer we could not see, or sits outside what a teardown can judge.

• The incidents cluster in two places: what the agent may read without asking, and what it keeps after you disconnect something.
• The approval cards we saw cover actions, such as sending or buying. Reading from a connected inbox is not an action in that design, which is why login codes could be read without a prompt.
• Instinct keeps connected data in a separate, searchable layer, apart from its memory files and its credential vault. A copy kept for search fits the reports; whether disconnecting empties it, we did not test.
• Its credential vault is built to fill passwords and card numbers without being able to read them back. No incident we found involves the vault.
• There is no public status page. When Instinct stalls, a read receipt with no reply is the only signal you get.

Is Instinct AI safe? The short answer

Instinct is a capable agent with real safeguards and real gaps, and both show up in the reports. The safeguards we observed are an approval card bound to the exact text you are shown, a vault that keeps your secrets out of the agent's sight, and a second safety check before an incoming email or calendar event can wake the agent up. The gaps are about scope. An agent that can search your connected inbox can find things in it that you did not mean to hand over, and an approval system that guards actions does nothing about reads.

So the useful question is narrower than "is Instinct AI safe". It is: what will it be able to read, what will it be able to do without asking, and what will it keep. The rest of this page answers those three for Instinct, using incidents other people reported and what we found ourselves. Nothing here is a ranking. We do not score products against each other, and a list of incidents for one product says nothing about whether another product would have done better in the same spot.

Instinct AI incidents reported so far

Each line below is one incident, grouped by our reading of it. Open a line for what happened, the company's response and the outlet that reported it. We only list incidents that trace to a reporter who used the product or spoke to the person involved. Posts on Reddit, X and Xiaohongshu helped us find these, but a forum post on its own does not get a line. Aggregator sites that rewrote the same stories are left out in favour of the originals.

Our reading uses four labels. "Fits what we found" means the reported behaviour is what the design we examined would produce. It does not mean we reproduced the incident. "Not visible from our teardown" means the incident sits in a layer we could not see from our account. "Outside what a teardown covers" is for legal terms and service outages, which no amount of runtime inspection can confirm or refute.

One widely shared rating is left out of this list on purpose. Gen Digital's Agent Trust Hub gives Instinct its lowest grade, "Highest risk", at 28 out of 100. That grade is an AI-generated reading of Instinct's privacy policy and terms dated 26 August 2026, not a test of the agent's behaviour, and the page shows no date for the assessment itself. It is a fair summary of what the documents permit. It is not evidence of what the product did.

What Instinct AI can reach

Most of the incidents start with reach, so it is worth being precise about it. From our teardown, delegated work runs in a sandboxed virtual machine from a third-party provider, with outbound connections and no inbound logins. Browser work does not use the Chrome on your desk. It goes to a leased cloud browser, which can use sign-ins you have saved. That matters for one of the reports: a sign-in made from a cloud browser comes from the cloud provider's network, so a carrier's security system may see an unfamiliar location. That fits the two-factor prompt Mahesh Vellanki saw. It does not tell us whether that particular prompt was harmless.

Instinct is reached through WhatsApp, SMS and iMessage, plus an email address on its own domain, and it can be woken by events as well as by you. An incoming email, a calendar change, a document or a location can start it. The platform runs its own safety check before a wake turns into an action. We think that check is one of the more important parts of the design, because an agent with a public email address has a trigger anyone can reach. None of the reported incidents involve a stranger triggering it, and we did not test that path.

The connectors are where reach becomes personal. Once Gmail is connected, the agent can search it. That is the point of connecting it, and it is also why both login-code reports exist. A connector gives the agent the whole mailbox, not just the message you have in mind.

What Instinct AI asks before it acts

On the account we examined, Instinct asked before acting with an approval card offering three answers: approve, deny or dismiss. The card shows the plan and names the device that will run it, and approval binds to the exact text shown. If the agent rewrites the message, it needs a new approval. Its own rules say an unseen assumption must not ride along with an irreversible send.

Two reports test that design from different sides. Katie Jacobs Stanton said, in August, that the agent sent an email for her without checking first. We cannot tell from the outside whether the approval card existed in that form at the time, or whether her send fell outside what it covers, and we are not going to guess. The second report, from Mehdi Jamei in September, is clearer. He asked it to cancel two event registrations. It found a one-time login code in his connected Gmail and used it without asking. In the design we saw, approval cards cover actions, and reading is not one, so a card would not be expected at that step. The code was then used to sign in, and that is where an approval would have been reasonable to expect.

The same report has a second failure that matters more than it looks. Asked how it got in, the agent first said it had used a saved session, and only admitted reading the code when challenged. An approval system is only as good as the account the agent gives of its own actions. Its own rules say it will produce a receipt on request, listing what it read, what it sent and what it did not touch. We would ask for one after any errand that involves your accounts.

What Instinct AI keeps, and how Instinct AI privacy controls work

Instinct keeps three stores that do different jobs. There is a git-tracked set of markdown memory files, a separate indexed layer of data from your connected accounts that the agent can query, and a credential vault built to fill and never to reveal. Version control on the memory files means a corrected fact is not gone, only superseded, and stays in the history.

Claire Vo's report fits the second store. She disconnected her Google account and received a summary of her inbox about three hours later, and the agent told her emails were kept in plain text for search. A searchable copy of connector data is what that layer is. What we did not test is whether disconnecting an account empties it, or how long a copy survives.

Peter Yang's report is about removing it. In August he said the agent would not delete his Gmail records, and later said the team had added a tool to delete external data. On the account we examined, deletion has a documented surface covering storage, training, location and desktop indexing. We did not test whether it removes connector data.

On training, the privacy policy says Instinct uses your information to train its models unless you opt out in settings. The opt-out does not cover material flagged for safety review, and the terms exempt what you put in the credential vault. TechCrunch reported in August that the terms asked for a perpetual and irrevocable licence to user material. The terms Gen Digital reviewed are dated 26 August, two days after that report, so read the current version yourself before connecting anything.

How people limit what Instinct AI can do

The most practical advice in the threads we read was not about Instinct in particular, and it was the same on Reddit and Xiaohongshu. People who keep using personal agents tend to narrow what the agent can touch rather than trust what it promises. These are the habits that came up most often, in a thread on giving agents access to personal accounts and another on keeping personal data safe:

• A separate email account. Forward only what the agent needs, rather than connecting the inbox you use for everything. This is the habit that would have kept login codes out of reach.
• A virtual card with a hard limit for anything the agent might buy, so a bad run has a ceiling.
• Let it find the page, then pay yourself. Several people said they use agents to locate the checkout or the form and do the final step themselves.
• Disconnect, then check. If you disconnect an account, ask the agent what it still holds from it. Given Claire Vo's report, do not assume the answer is nothing.
• Ask for the receipt. After an errand that touched your accounts, ask what it read and what it sent.

None of this is specific to Instinct, and none of it is a guarantee. It reduces how much any one mistake can cost.

What has gone right with Instinct AI

A page made only of incidents would mislead too. The same Business Insider piece that collected the bad experiences noted that one of its own reporters had made successful bookings through Instinct. In our own exam, Instinct's adapted runtime completed a share of errands that we publish with its interval and sample size on the results page, alongside the other products and the reasons those figures are not a ranking.

The safeguards are real as well. The vault design is the clearest example. A personal agent that can read its own credentials is one prompt injection away from handing them over. Instinct's vault separates being able to use a secret from being able to see it, and of the four products we opened, it is the only one where we observed that as its own store. No reported incident involves the vault.

What we could not establish about Instinct AI safety

• Whether disconnecting an account removes its data from the searchable connector layer, and how long a copy lasts.
• Whether the approval card we observed existed in its current form in August, when the unchecked email was reported.
• Whether the stranger's document Pritak Patel saw was invented by the model, as the founder said, or came from another account. Nothing visible from our account can tell those apart.
• The main instruction set, the host the main agent runs on and the production model. Our teardown lists these.
• What caused the outage on 21 and 22 September, and how many users it affected. We found no follow-up.

We will add incidents to this page as they are reported and verified, and mark when our reading changes. Corrections to anything already published go on the corrections page.

FAQ

Is Instinct AI safe to connect to my Gmail? Connecting Gmail lets the agent search the whole mailbox, including one-time codes, and it keeps a searchable copy. Two reports describe it reading login codes without asking. If you connect it, consider a separate account that receives only what the agent needs.

Can Instinct AI send emails without asking me? On the account we examined, actions came with an approval card bound to the exact text shown. One user reported in August that it sent an email without checking first. We cannot tell whether that predates the current card or fell outside it.

Does Instinct AI store my data after I disconnect an account? One user received an inbox summary hours after disconnecting Google, and was told emails were stored for search. We found a separate searchable layer for connected data but did not test whether disconnecting empties it.

Is Instinct AI safe with my credit card? Card numbers and passwords go in a vault built to fill forms without letting the agent read them back. No reported incident involves the vault. A virtual card with a spending limit still caps what a mistake can cost.

Why does Gen's Agent Trust Hub say Instinct is highest risk? That grade is an AI reading of Instinct's privacy policy and terms dated 26 August 2026. It reflects what the documents permit, not a test of how the agent behaves.