Instinct, the invite-only personal AI assistant from Spear Street Technology, raised $350 million at a $2.5 billion valuation within weeks of its first private invites going out — and landed on TechCrunch for its privacy story before most people had even heard of it. That combination of capability and controversy makes it worth examining carefully.
This review is based on Instinct's own site and terms of service, launch-week reporting by TechCrunch, the Vellum breakdown drawing on early-user accounts, and public posts from beta testers. We have not used the product ourselves.
Key takeaways
- Instinct is a personal AI assistant you text or call, built by Spear Street Technology (San Francisco). It connects to email, messaging, screen, audio, and location to complete tasks end-to-end.
- Early users report genuinely impressive task completion: negotiating bills, coordinating vendors across time zones, filling out medical paperwork without being asked twice.
- Its terms of service authorise it to enter binding agreements on your behalf, and it collects screen captures, keyboard inputs, and location data — concerns that reached TechCrunch within days of launch.
- Three documented incidents from beta users — retained data after disconnection, a successful prompt-injection attack via email, and an unapproved action — show the security model is still maturing.
- For work tasks, Instinct's broad-access model creates a specific problem: it has no way to know what your company considers confidential, who is allowed to see what, or what your business has actually committed to. A company brain takes the opposite approach — the organisation decides what gets indexed, and every answer respects the source's permissions.
What is Instinct?
Instinct is a personal AI assistant from Spear Street Technology, Inc., a San Francisco company registered in April 2026 by Noah Shinn, previously a research scientist at Sierra, according to Forbes via Vellum's breakdown. The public site names no founders. Access is currently invite-only, with a waitlist.
The pitch is simple: no new interface. You text it on iMessage or WhatsApp, or call it, and it uses a persistent cloud computer with stored credentials to act on your behalf. It books the restaurant, negotiates the bill, fills in the forms, and follows up — without being asked twice.
Investor Anish Acharya described the architecture as a top-level agent that dispatches work to sub-agents running on a cloud computer with browser access and cached credentials. Instinct made the consumer-product tradeoffs that hide almost all of that machinery.
Pricing has not been published. The product is free during private beta. TechCrunch reports that Spear Street confirmed a $250 million Series B at a $2.5 billion valuation led by Index Ventures and Benchmark, following earlier rounds led by Conviction, Greenoaks, and Kleiner Perkins.
What Instinct does well
The task range reported by early users is wider than the typical AI assistant demo.
Sheel Mohnot posted 677 messages exchanged in five days and 15 completed jobs: finding an in-network podiatrist and filling out all the paperwork, negotiating a Comcast bill down from $100 to $60 per month, messaging wedding-merch vendors on WhatsApp across time zones while he slept, and organising a WhatsApp group's travel details into a spreadsheet. He called it "OpenClaw for normal people."
What separates these reports from typical AI assistant demos is completion. Instinct follows up. It calls or texts you first when something needs a decision. It holds the thread on a task across days. For personal logistics — travel, subscriptions, scheduling, vendor coordination — that persistence is the product.
The architecture supports it. A persistent cloud computer with cached credentials means Instinct keeps working between your messages. The single continuous conversation thread means context doesn't reset. For personal life admin, that is exactly the right design.
Where Instinct falls short
The launch week produced a public record of security incidents that most products never accumulate this fast.
Retained data after disconnecting. Claire Vo disconnected Google access at 11 AM and received an inbox summary at 2 PM. She found full message text in her data export and initially had no way to delete the stored records. Per Vellum's breakdown, the team acknowledged the gap and added a deletion tool in settings after Peter Yang hit the same wall.
Prompt injection via email. Hello Patient co-founder Alex Cohen emailed his own inbox malicious instructions as a test. Instinct followed them and returned a summary of open tasks. He deleted his account.
Unapproved action. A Moxxie Ventures founder reported an action taken without explicit approval. The details in the available sources are partial, but the pattern is consistent: an agent with broad access and real authority to act is a larger attack surface than one with narrow, scoped permissions.
The terms of service formalise the exposure. Instinct's own terms appoint the service as your agent, authorised to enter binding agreements and transactions on your behalf. The terms also describe receiving screen captures, cursor movements, and keyboard inputs. TechCrunch covered the combination of sweeping access, broad terms, and the ability to act on users' behalf as the core concern.
These are documented incidents from an early private beta, and the team has responded to at least one of them. But the pattern matters: broad access granted upfront, with permission questions asked later or not at all, is a design choice with real consequences.
For personal use, each person can weigh that tradeoff for themselves. For work use, the tradeoff belongs to the organisation — and Instinct has no mechanism for that.
How would Instinct improve on a company brain?
This is where the design tension becomes concrete. Instinct gets context by asking for broad access to a person's devices and accounts. A company brain takes the opposite route: the organisation chooses exactly what gets indexed, and every answer carries the source's permissions.
That difference matters most when Instinct is used for work tasks. Here are three situations where missing business context produces a wrong or dangerous outcome.
| Task | Without company context | With a company brain |
|---|---|---|
| "What did we promise Acme in the renewal?" | Instinct searches your email and may surface an early draft, a superseded term, or nothing — it has no way to know which document is authoritative | A company brain surfaces the signed contract from Drive, cites the source, and respects the permission level — only people with access to that file see that answer |
| "Can I share our Q3 roadmap with this prospect?" | Instinct has no concept of what your company considers confidential or who is allowed to share what | A company brain reflects the indexing decisions the organisation made — a document marked team-only does not surface in a response to someone outside that team |
| "Draft a follow-up to the Acme call" | Instinct can draft from your email history, but it has no access to the CRM notes, the support tickets, or the Slack thread where the real context lives | A company brain pulls the HubSpot record, the relevant Slack thread, and the last support ticket, then drafts with that full picture |
The prompt-injection incident is instructive here. An attacker who knows your assistant reads your inbox can send an email with instructions. An assistant with no concept of organisational trust boundaries — no distinction between a message from a colleague and a message from a stranger — will follow instructions from either. Permissioned, source-cited context is part of what makes an agent safer to deploy on real work.
The data-retention incident points to a related gap. When an individual disconnects a personal account, the expectation is that data disappears. In a work context, that expectation applies to the organisation: when an employee leaves, when a project closes, when a contract ends, the company needs to know what data the agent held and be able to remove it. Instinct's current model has no organisational layer for that.
On MCP: Bland's integration documentation notes that Instinct's public site does not document custom MCP server connections or authenticated API requests, and recommends confirming these capabilities directly with Instinct before assuming they exist. If Instinct were to support MCP connections, it could in principle receive context from a company brain served as an MCP server — the same way Claude Code or Cursor can today. Without that, the two systems operate in separate silos.
For a fuller picture of how a managed company brain differs from building your own context pipeline, the comparison at Gyld's vs page is worth reading alongside this.
What a company brain would not fix
Being honest about the limits matters here.
A company brain addresses the context problem — what the agent knows about the organisation, who is allowed to see it, and where the answer came from. It does not fix:
- Model reliability. If Instinct's underlying model misreads an instruction or hallucinates a fact, richer context helps but does not eliminate the risk.
- The prompt-injection surface. Permissioned context narrows the attack surface, but an agent that reads external inputs — email, messages from strangers — needs injection defences at the model and architecture level, not just better context. Why rogue AI agents happen, and what actually prevents them, is covered in more depth here.
- Unapproved actions. An agent that can enter binding agreements needs approval workflows, not just better knowledge. Context tells the agent what the company has agreed to; it does not enforce a confirmation step before the agent commits to something new.
- Data retention and deletion at the infrastructure level. The gap Vo and Yang found is an infrastructure and policy problem. A company brain that indexes the right documents still depends on the underlying platform honouring deletion requests promptly.
- Pricing uncertainty. Instinct is free during beta. The business model — subscription, advertising against the data the agent can reach, or something else — is not yet public. That uncertainty is part of the buying decision for any organisation considering it for work use.
Verdict
For personal life admin — subscriptions, travel, medical paperwork, vendor coordination across time zones — Instinct is the most capable assistant in this category right now, and the early-user reports are credible. The persistence and the follow-through are real differentiators.
For work use, the current design is not ready. The security incidents are documented, the terms are broad, the data-retention model is still being fixed, and there is no organisational permission layer. An individual contributor using it for their own email is making a personal risk decision. A team deploying it on shared work data is making a decision that belongs to the organisation — and the organisation has no controls here yet.
What would change the verdict: explicit MCP support so context can be scoped and permissioned at the company level; an organisational account layer with role-based access and auditable data retention; and a published response to the prompt-injection finding at the architecture level, not just a post-incident patch.
The funding and the early capability are real. The security model needs to catch up before this belongs in a work context.
Frequently asked questions
What is Instinct AI?
Instinct is an invite-only personal AI assistant built by Spear Street Technology, Inc. in San Francisco. You text or call it, and it uses a persistent cloud computer with stored credentials to complete tasks end-to-end — booking appointments, negotiating bills, coordinating vendors, and managing subscriptions. It launched in private beta in August 2026 and raised $350 million at a $2.5 billion valuation within weeks.
Who built Instinct?
Spear Street Technology, Inc., registered in California in April 2026. Forbes, cited in Vellum's breakdown, reports the entity was registered by Noah Shinn, previously a research scientist at Sierra. The public site names no founders.
Is Instinct safe to use?
Three documented incidents from early beta users — data retained after disconnection, a successful prompt-injection attack via email, and an unapproved action — show the security model is still maturing. Instinct's terms authorise it to enter binding agreements on your behalf and describe receiving screen captures and keyboard inputs. The team has patched at least one of the documented gaps. For personal use, each person can weigh the tradeoff. For work use on shared or confidential data, the current model carries risks the organisation cannot yet control.
How much does Instinct cost?
No price has been published. The product is free during private beta. Access is invite-only, with a waitlist.
Does Instinct support MCP?
Instinct's public site does not document MCP server connections or authenticated API requests, according to Bland's integration documentation. This should be confirmed directly with Instinct before assuming it is possible.
What is a company brain, and how does it differ from Instinct's approach?
A company brain is a permissioned knowledge base built from the apps an organisation already uses — Slack, Gmail, Notion, HubSpot, and others — that AI agents can query with source citations and access controls. Instinct gets context by asking for broad device access; a company brain gets context by having the organisation choose exactly what to index and who can see each answer. The two models solve different problems: Instinct is optimised for personal task completion; a company brain is optimised for organisational knowledge with boundaries.
Could Instinct use a company brain for work tasks?
In principle, if Instinct were to support MCP connections, it could receive context from a company brain served as an MCP server — the same way Claude Code or Cursor can today. Instinct does not currently document that capability. Without it, the agent has no access to the permissioned, source-cited company knowledge that work tasks require.
What tasks is Instinct best suited for right now?
Personal life admin: finding and booking in-network doctors, negotiating service bills, coordinating vendors across time zones, managing subscriptions, and organising information from messaging apps. Tasks that require organisational permissions, confidentiality controls, or access to shared business data are not well-served by the current design.
Related reading
- AI Agent Safety Is a Context Problem — Here's Why: The prompt-injection incident at Instinct is a specific instance of a broader pattern. This post explains why context boundaries are a safety mechanism, not just a convenience.
- Why Rogue AI Agents Happen — and How a Company Brain Prevents Them: Covers the architecture decisions that make agents safer to deploy on real work data, including why broad access models create larger attack surfaces.
- Best Tools to Connect Company Data to AI Agents in 2026: If you want an agent that understands your business, this is the current landscape of options.
- MCP Adoption Statistics 2026: Growth, Servers, and Agent Tool Use: Context on how MCP is becoming the standard connector between agents and company knowledge.
If Instinct's capability interests you but its access model gives you pause for work tasks, the answer is giving your AI tools permissioned company context rather than broad device access. Start building your company brain at Gyld — connect Gmail, Slack, Notion, or HubSpot, and your agents answer from your actual business data, with the source attached.