When an AI assistant can read your inbox, book a table, and sign on your behalf, who holds the keys?
Instinct is a high-capability personal AI assistant in private testing that connects to email, messaging apps, calendars and device inputs and performs tasks via text or WhatsApp. Testers on X called it “like magic” and compared it to recent assistants such as OpenClaw (TechCrunch, Sarah Perez, Aug 24, 2026). But screenshots of Instinct’s Terms of Service and several early-user reports, collected and published by TechCrunch, show sharp privacy and security questions that any business leader should treat as operational red flags (TechCrunch, Sarah Perez, Aug 24, 2026).
TL;DR for executives
- High reward: agents that can act across apps and devices materially speed scheduling, triage, and repeatable tasks.
- High risk: Instinct’s reported ToS and tester anecdotes raise concerns about long-term data rights, device telemetry, retained plaintext content and the agent’s ability to execute transactions for users (TechCrunch, Sarah Perez, Aug 24, 2026).
- Short action list: don’t pilot in production; require least-privilege connectors and short-lived tokens; demand hard-delete guarantees, third-party audits (SOC 2 / pentest), and contractual limits on transactional authority.
What the reporting shows, and what remains unverified
TechCrunch’s reporting reproduces ToS screenshots and names early testers who experienced risky behavior. The key, attributed items are:
- The ToS reportedly grants a broad “perpetual and irrevocable” license to “access, use, host, cache, store, reproduce, transmit, display, publish, distribute, and modify” users’ materials, explicitly “including for training its AI models” (TechCrunch, Sarah Perez, Aug 24, 2026).
- The ToS also reportedly permits receiving device telemetry such as screen captures, cursor movements and keyboard inputs (TechCrunch, Sarah Perez, Aug 24, 2026).
- Language in the ToS allows the assistant to enter into “agreements, commitments, or transactions” on a user’s behalf (TechCrunch, Sarah Perez, Aug 24, 2026).
- Early-user incidents reported by TechCrunch include a failure-to-delete Gmail record later addressed with a deletion tool (Peter Yang), continued inbox summarization after disconnect with the company indicating emails were stored in plain text for search (Claire Vo), a sign-up code pulled from email during a booking flow, reported phishing vulnerability concerns (Alex Cohen), and an instance where an email was sent on a user’s behalf without prior confirmation (Katie Jacobs Stanton) (TechCrunch, Sarah Perez, Aug 24, 2026).
- TechCrunch also reported that it “heard from multiple investors that Kleiner Perkins and Conviction have invested” and that outreach to the company went unanswered as of that story (TechCrunch, Sarah Perez, Aug 24, 2026).
These are the facts as reported. What the public record does not yet establish are the product’s full technical safeguards (encryption, token handling, internal access controls), the legal enforceability of the ToS across jurisdictions, or how broadly the company actually uses customer data for model training in practice. Those are critical follow-ups you should demand before any rollout.
Why this matters to your business
Personal AI agents extract value by combining data from multiple silos. That is why they can be powerful assistants and why they create compound risk. Calendar items, legal drafts, HR notes and authentication codes can be stitched together into actions that have legal or financial consequences.
Three practical risk categories stand out:
- Data governance and retention: A “perpetual and irrevocable” license and evidence of plaintext indexing raise questions about who may access content, how long it’s kept, and whether deletion is meaningful. A vendor’s ToS cannot simply override statutory privacy rights, and data-protection laws such as the EU’s GDPR and California privacy law impose rights and limits. Enforceability depends on jurisdiction and customer status. Consult counsel and ask vendors how they reconcile their terms with applicable law.
- Transactional authority: Allowing an agent to enter into agreements on a user’s behalf creates contract and fraud risk. Whether a particular automated action is legally binding varies by jurisdiction and the specifics of consent and authentication. Require vendors to document confirmation flows, caps and legal analysis before enabling such features.
- Authentication and phishing: Any system that stores tokens, reads sign-in links or captures one-time codes widens the attack surface. Testers’ phishing concerns are realistic. Attackers target systems holding reusable authorization artifacts and session tokens.
What leaders should ask vendors, and which answers are acceptable
Ask these questions early and require written, auditable answers. Below are the priority questions and examples of satisfactory responses you should insist on.
- Do you use customer content to train models?
Acceptable answer: “No production-model training on identifiable customer content. Any aggregated telemetry used for model improvement is anonymized and only with explicit, documented opt-in; customers can opt-out contractually.” - How are credentials stored and managed?
Acceptable answer: “We never store plaintext passwords. We use OAuth scopes, short-lived tokens and a secrets vault with customer-specific key management; tokens are rotated and logs show no reusable credentials accessible to staff.” - What telemetry do you actually collect?
Require precise disclosure: is screen capture or keystroke telemetry collected by default or only under narrow, explicit consent? If collected, how is it minimized, retained, and access-controlled? - How does deletion work?
Require a hard-delete process: removal from search indices and primary stores within a defined SLA, deletion from backups within a documented period, and a deletion certificate or audit trail. Make deletion obligations contractual. - When can the assistant act without explicit confirmation?
Insist on default “never act without explicit, logged confirmation” for any action that could be binding or financial. If vendors permit automated actions, demand transaction caps, mandatory 2FA for high-risk flows, and immutable audit logs. - Do you provide independent security attestations?
Required evidence: recent third-party pentest report, SOC 2 Type II (or equivalent), and a published security incident response plan. For enterprise pilots, ask for red-team results or the scope of tests conducted against the live service.
Minimum technical and contractual must-haves for pilots
- Least-privilege OAuth connectors (no password sharing).
- Short-lived tokens, no long-lived credentials stored in plaintext.
- Customer-managed keys (or clear encryption-at-rest policy) and role-based access controls for staff.
- Per-matter data separation for legal/HR/finance streams and DLP integration.
- Immutable, exportable audit logs of every action the assistant takes.
- Hard-delete guarantees with contractual remedies and a documented SLA.
- Third-party security attestations (SOC 2 Type II, recent pentest) and an incident disclosure timeline.
Red flags that should block a rollout
- Vendor refuses to commit in writing that customer content won’t be used for training without explicit opt-in.
- No verifiable hard-delete process across indices and backups.
- Storage of long-lived credentials or plaintext OTPs.
- Default telemetry collection that includes screen captures or keystrokes without granular, revocable consent.
- No third-party security attestations or refusal to share pentest summaries under NDA.
Practical pilot design, start small, instrument everything
Run pilots on a narrow, auditable scope (calendar management, meeting summaries, or inbox triage for non-sensitive mail). Pair the pilot with:
- Scoped access tokens and strict matter-level separation.
- Continuous monitoring for anomalous outbound actions and phishing attempts.
- Predefined failure modes: automatic suspension on unexpected transactional attempts or token anomalies.
- User workflows that require explicit confirmation for any message-sending or transaction-capable action.
Sample vendor answers that would satisfy me
- “Do you use customer content to train models?”
Acceptable vendor response: “No identifiable customer content is used to train production models. We may use aggregated, de-identified telemetry for non-production model tuning only after explicit customer opt-in; customers can revoke opt-in and require deletion of their historical data used for tuning.” - “How does deletion work?”
Acceptable vendor response: “Deleted content is removed from active indices within 24 hours, removed from backups within 30 days, and a deletion certificate is issued. Any model artifacts that included that data are retrained or rolled back where feasible; we provide contractual indemnities for failures to delete.”
Legal nuance, Terms of Service aren’t the final word
A vendor’s ToS can claim broad, perpetual rights. But those contractual claims do not automatically eliminate statutory privacy rights or consumer protections. Enforceability depends on jurisdiction, whether the customer is an enterprise or consumer, and local law (for example, GDPR and California privacy statutes). Don’t rely on ToS language alone, get legal review and require the vendor to explain how its terms map to regulatory obligations and enterprise customers’ compliance needs.
Key questions and honest answers leaders will ask
- Can Instinct legally keep and train on my data forever?
TechCrunch reported ToS language granting a “perpetual and irrevocable” license for user materials, including for model training. Whether that clause is enforceable, how broadly it’s applied, and whether opt-outs or anonymization are offered has not been publicly clarified by the company (TechCrunch, Sarah Perez, Aug 24, 2026). Ask the vendor for a contractual carve-out or explicit opt-out if you want to prevent training use.
- Does the assistant capture device-level inputs like screen images or keystrokes?
TechCrunch reproduced ToS text saying it can receive screen captures, cursor movements and keyboard inputs (TechCrunch, Sarah Perez, Aug 24, 2026). It’s not clear from public reporting whether that telemetry is collected by default or only with explicit consent; demand a precise, auditable description of telemetry collection and a way to opt out.
- Could the assistant bind me to contracts or transactions?
The ToS reportedly permits the assistant to enter into “agreements, commitments, or transactions” on users’ behalf (TechCrunch, Sarah Perez, Aug 24, 2026). Whether a resulting action is legally binding depends on jurisdiction, consent mechanisms, and corporate policy, require explicit confirmation flows, caps, and legal analysis before enabling transaction capabilities.
- Are these concerns theoretical or backed by real incidents?
Both. Testers reported concrete problems: a failure-to-delete Gmail record (later addressed with a deletion tool), continued inbox summarization after disconnection with emails reportedly stored in plain text for later search, a sign-up code pulled from email during a task, phishing vulnerabilities noted by testers, and an email sent on a user’s behalf without confirmation (all reported in TechCrunch’s coverage, Sarah Perez, Aug 24, 2026).
- Should I block these agents entirely?
Not necessarily. Agents can free up meaningful time for sales, customer ops and scheduling teams. But treat them like privileged systems: require transparency, technical controls, contractual protections, independent security attestations and start with a narrow, auditable pilot before broad deployment.
One line to remember
Vendors will promise productivity; you should demand proof, in the form of least-privilege access, verifiable deletion, independent audits and contractual limits on transactional power, before you hand an agent the keys to your systems of record.
If you’re evaluating any assistant that reaches into inboxes, calendars or payment flows: don’t pilot in production, require the red-flag checklist above as contractual commitments, demand third-party attestations, and begin with a tightly scoped, auditable use case.