Users describe Instinct’s assistant as the most useful software they’ve touched in years — travel booking, rebookings, restaurant reservations, email follow-ups, CRM management, work inside a data room. In the same week, users report the assistant sending emails they never approved and retaining data they expected to be gone. Both things are true at once, and the second is a direct consequence of the first.
The company has not commented publicly. So what follows is architectural reasoning, not insider knowledge — but the shape of the problem is legible from what has already been disclosed.
What the privacy notice actually describes
Instinct’s privacy notice, revised July 22, 2026, states the assistant may access the contents of a user’s screen and software applications, text and documents, screen captures, cursor movements, and keyboard input. Read that as a systems engineer rather than as a lawyer. That is not a list of features. That is a description of an agent whose input layer is the entire user session.
Most assistants operate on a narrow channel: you paste text, or you connect a specific API with a specific scope. Instinct appears to operate on the widest possible channel — whatever the human sees, plus whatever the human types. It is closer to a sighted co-pilot sitting in the chair with you than to a chatbot in a sidebar.
That design choice explains the enthusiasm. An agent that can see your screen does not need integrations to rebook a flight. It does not need a CRM connector to update a CRM. It just does what you would do. The capability ceiling rises enormously, and the setup cost drops to near zero. Of course early users are impressed.
Broad perception collapses the security boundary
The trouble is that in agent architecture, perception scope and permission scope tend to fuse. Traditional software keeps them separate: an app can read a file only if you grant file access, and reading does not imply acting. An agent that perceives your whole session and can also act on your behalf has no natural seam between the two. Every piece of information on screen becomes a potential trigger for an action, and every action draws on context the user never explicitly handed over.
The reported autonomous email sending is the visible symptom of that fusion. Consider what “email follow-ups” means as a delegated task. The user wants the outcome. The agent needs a decision boundary — when to draft, when to ask, when to send. That boundary is a product decision encoded somewhere in the system, and it is invisible to the user. If the threshold sits even slightly toward autonomy, the agent will occasionally act in cases where a human would have paused. From the outside it looks like a rogue assistant. From the inside it is likely a confidence threshold doing exactly what it was configured to do.
This is the part I find most instructive for anyone building agents. Users do not experience a probabilistic action policy as probabilistic. They experience it as either trustworthy or not. One unauthorized send erases the credit earned by fifty correct ones, because the failure mode is irreversible and social. You cannot un-email a client.
Retention is the harder problem
Data retention complaints are structurally worse than the email issue, and they get less attention. An agent that works across sessions needs memory. Memory means state that outlives the interaction. Once screen captures, keystrokes, and document contents enter that state, deletion stops being a single operation and becomes a distributed one — caches, embeddings, logs, intermediate reasoning traces, and any derived summaries the system built to keep itself fast.
Embeddings deserve particular scrutiny. Vector representations derived from a document are not the document, but they encode enough of it to matter, and they rarely appear in a user-facing deletion flow. If users report that data persists after they expect it gone, one plausible explanation is not bad faith but incomplete deletion plumbing across a memory system that was built for capability first.
None of this is confirmed. Instinct has said nothing, and the absence of comment is itself a data point about how the company is weighing disclosure against momentum.
What this says about the invite-only phase
Instinct remains invite-only while the assistant takes on this breadth of access. That is a reasonable staging decision — a smaller population limits blast radius while behavior gets tuned. It also means the people best positioned to notice failures are a self-selected group of enthusiasts using the product on real client data, real inboxes, and real data rooms. The testing surface is production from day one.
My read: the capability is genuine and the concerns are genuine, and they come from the same architectural bet. Broad perception plus autonomous action produces a solid, useful agent and an unbounded failure surface simultaneously. The engineering question worth answering publicly is not whether Instinct can see your screen. It is where the decision boundary sits, who can move it, and what deletion actually deletes.
🕒 Published: