Three hours after Claire Vo disconnected an AI agent called Instinct from her Google account, it sent her a summary of her email. She hadn't asked for one. She'd revoked access that morning.
That's the incident now circulating around Instinct, an invite-only personal AI agent from San Francisco startup Spear Street Technology, Inc., and it's a more useful story than the average product-launch controversy. It isn't really about whether Instinct is a good product — early testers, including Sheel Mohnot, have called it close to magic. It's about a gap that any agent with standing access to your accounts can fall into: revoking access is not the same thing as deleting data, and the terms of service that let an agent act on your behalf can grant far more than the task in front of it needs.
What Instinct is and how it works
Instinct is built for people who want an assistant without a dashboard. You text it over iMessage — no separate app to open, no web console to configure — and it handles the kind of task that normally means ten minutes on hold or a form nobody wants to fill out: canceling a subscription, paying a toll, rescheduling an appointment, negotiating a bill down. Mohnot, describing it as "OpenClaw for normal people," said he'd exchanged 677 messages with it in five days and had it find an in-network podiatrist and cut his Comcast bill from $100 to $60 a month.
To do that, Instinct links into email, calendar, and other apps and acts on the user's behalf — the same pattern behind every "personal AI agent" product racing to market in 2026, from browser agents to always-on desktop assistants. Access to Instinct is currently invite-only, gated by a waitlist, which has drawn its own skepticism: Ian Kar asked bluntly whether any non-VC has used it yet, a fair jab at how insider-heavy the early access pool looks for a product already being described in magic terms.
What actually happened: revoked access, retained data
Here's the sequence, as Claire Vo — a three-time CPTO, builder of ChatPRD, and host of the How I AI podcast — described it: she disconnected Instinct from Google at 11 AM. At 2 PM, she got a summary of her emails anyway. Looking into why, she found 36 Gmail messages still sitting in Instinct's stored records, hours after the connection was supposedly cut. Deleting them wasn't automatic — it required a special request to the Instinct team, not a self-serve action available at the moment of disconnection.
Her own framing of it was notably measured, not alarmist: she called herself "a forgiving tester who understands the tradeoffs," while flagging directly to the team that "I'm not sure others will be quite so forgiving." That distinction matters. This wasn't a breach or an exploit — nobody hacked Instinct to get at those 36 messages. It was the agent behaving exactly as its architecture allowed: a "revoke" button that stopped new access but left a standing local or cloud copy of what it had already ingested untouched.
Peter Yang, a product leader who follows AI tooling closely, put the practitioner objection plainly: it's "not cool to index and retain my emails without my permission and not let me delete them from your records," adding that he couldn't recommend the product to anyone until it was fixed. That's the bar a personal agent handling someone's inbox has to clear, and Instinct's current design didn't clear it.
The terms-of-service question
Separately from the retention finding, reporting around the incident describes Instinct's terms of service as permitting notably broad access — including screen captures, keystrokes, and passwords, on top of email and calendar integration. explainx.ai attempted to independently verify the exact language of Instinct's published terms and was blocked from fetching the page directly; we're reporting this as widely circulated but not independently confirmed at publication time, and would update this post if the company clarifies scope publicly.
What's not in question is the shape of the concern: an agent that reads keystrokes and screen content to complete a task like "pay this toll" is requesting access several tiers broader than the task requires. That gap between requested scope and task scope is the same failure mode explainx.ai has covered in why agent skills are a security risk — a tool that can do more than its stated job is a tool that eventually gets asked, by someone, to do that something more.
The practitioner lesson: revoke ≠ delete
This is the part worth internalizing whether or not you ever install Instinct. Any system built on OAuth-style permission grants — Google, Microsoft, Slack, your CRM, your bank — separates two actions that people intuitively treat as one:
| Action | What it actually does |
|---|---|
| Revoke access | Stops the app from making new API calls or pulling in new data going forward |
| Delete data | Erases data the app already copied, cached, indexed, or embedded — a separate operation the provider has to build and, often, the user has to explicitly request |
Nothing about revoking a Google OAuth token retroactively deletes what a third-party app already ingested. That's true of Instinct, and it's true of most agent integrations shipping today. The difference is whether the provider treats revocation as a delete trigger by design — purging cached copies within a stated window — or whether, as in Instinct's case, deletion sits behind a manual support request that a "forgiving tester" has to go looking for.
For anyone building or evaluating agent tooling, three questions belong in the trust checklist before granting any agent standing access to a personal account:
- What happens to already-ingested data when I revoke access? If the answer isn't published, assume it's retained indefinitely.
- Does the requested permission scope match the task? An agent that pays tolls doesn't need standing screen-capture and keystroke access; an agent that reads your calendar to book appointments doesn't need your passwords. explainx.ai covers this same scope-discipline problem — least privilege applied to AI tools rather than employees — in the MCP security guide and in how Claude Code's permission modes draw the same line for coding agents.
- Is deletion self-serve, or does it require a support ticket? A "special request" step is a design decision, not a technical limitation — deletion-on-revoke is buildable; Instinct's current flow shows it wasn't the default.
The adjacent risk: trust is the attack surface
Ken Wattana raised a different but related concern worth naming explicitly: Instinct is, in his words, "built by legit people and backed by trusted investors," but the same dynamic that makes it compelling — people handing over account access and payment information to a text thread — is exactly the setup a bad actor would want to clone. A convincing "new personal agent, invite-only, early access" pitch is a phishing template that writes itself once a real product like Instinct has normalized the ask. Sahil Bloom's joking worst-case — that Instinct itself could be a state-sponsored espionage tool exploiting VC clout-chasing and FOMO — lands as satire specifically because the mechanics it describes (broad access, high trust, minimal scrutiny, viral adoption) are real and don't require an actual espionage operation to be dangerous. An impersonator running the exact same playbook against Instinct's own early adopters is a far more mundane, far more likely risk.
This is the same lesson explainx.ai has made about indirect prompt injection in a different form: an agent's usefulness is proportional to how much it's trusted with, and that same trust is the surface an attacker targets — whether through injected instructions or through a convincing impersonation of the product itself.
What good agent data practice looks like
None of this makes personal AI agents a bad idea — the category is real, the time savings testers describe are real, and consumer AI agent adoption is still gated more by trust than by capability. What separates a defensible agent design from a risky one is a short list of practices Instinct's incident makes concrete by their absence:
- Auto-delete on revoke, within a stated window. Publish the window (24 hours, 7 days, whatever it is) rather than leaving deletion to a support request.
- Scope permissions to the task, not the account. Reading a calendar to book an appointment is a different ask than standing keystroke and screen-capture access; bundling them because it's technically simpler pushes the risk onto the user.
- Make deletion self-serve. A settings-page "delete my data now" button that actually purges stored copies, not a "contact us" form.
- Publish what's retained and why, the way a privacy policy should read before a product goes viral, not after a tester finds 36 leftover emails and has to ask.
- Assume impersonation risk from day one. A trending agent that asks for account and payment access is a phishing target the moment it gets attention — verify official channels, and design onboarding that makes a spoofed clone harder to pass off as legitimate.
Claire Vo's response to all this was itself a model of how a tester should handle it: public, specific, and still open to the company fixing it — she posted directly asking the Instinct team to get in touch and said she's "here for feedback." Whether Instinct closes that gap will say more about the product's actual trustworthiness than anything in its onboarding flow.
Related on explainx.ai
- Why agent skills are a security risk — and how explainx.ai verifies every skill
- MCP Security Guide 2026
- What Is Indirect Prompt Injection? How Web Content Hijacks AI Agents
- Claude Code Permission Modes Explained
- Why AI Agents Haven't Gone Mainstream
- How to Restrict What Claude Desktop Can Access on Your Computer
- What Are AI Agents? A Plain-English Beginner's Guide
This post is based on public commentary from Claire Vo, Peter Yang, Ian Kar, Ken Wattana, Sahil Bloom, and Sheel Mohnot circulating on X in August 2026, aggregated reporting on the incident, and Instinct's public-facing pages. explainx.ai could not independently verify the exact wording of Instinct's terms of service regarding screen capture, keystroke, and password access at publication time; that detail is reported as circulating, not independently confirmed. Details are accurate as of August 22, 2026, and may change if Instinct or Spear Street Technology issue a public response.