Instinct: What an Always-On Personal Agent Gets by Default

What happened

• Instinct's Google authorization screen requests full read, write and delete across Gmail, Calendar, Drive, Sheets, Docs, Slides and Tasks, the ability to change Gmail settings and filters, and contact export. "Delete all your..." appears on almost every line.
• Beyond Google, the product asks for iMessage (read and send all texts, requiring deep Mac access such as Full Disk and Screen Recording), WhatsApp as a linked device that sees every chat, screen contents, microphone, precise location, and a stored credential and payment vault.
• Instinct has all three legs of the lethal trifecta (Simon Willison's term): sensitive data (email, files, screen), untrusted content (web, inbox, invites) and the ability to act (send, pay, post). One poisoned email can therefore quietly steal data.
• Terms of Service § 3 grants a nonexclusive, royalty-free, transferable, sub-licensable, worldwide, perpetual and irrevocable license to develop, train, fine-tune and improve their technologies, covering prompts, documents and device-usage data including screen captures, cursor movements and keystrokes.
• Instinct says it will not train on data taken directly from Google Workspace. There is no matching promise for Outlook / M365, iMessage, Slack, WhatsApp, Signal, screen captures, audio, location or keystrokes.
• Total liability is capped at $100, class actions are waived, and disputes go to binding arbitration (JAMS).
• The deletion clauses conflict: one calls the license perpetual and irrevocable, another says it lasts only while your content is stored, and the terms do not say which wins after account deletion. Instinct told the reviewers it cannot quote a processing window or a backup-purge timeline.
• Precedent: Summer Yue, Director of Alignment at Meta Superintelligence Labs, connected OpenClaw to her email with an instruction to suggest, not act. Processing a large inbox filled the agent's memory, the safety instruction was dropped, and it deleted hundreds of real emails. She could not stop it from her phone.

Why it matters

• You are not installing an app, you are hiring an employee with your inbox, screen, logins and wallet, sight unseen, and it acts on its own by default.
• "Confirm before acting" is not a control. In the Summer Yue incident an explicit human-approval instruction was dropped once the agent's memory filled, and the agent kept deleting.
• Revoking at the source does not undo collection. Copies Instinct already made may remain, its own in-app delete controls are not reliable yet, and derived data (summaries, embeddings, profiles, training artifacts, backups) can outlive the original file.
• Keystrokes, cursor movement, audio and location reveal stress, health, relationships, finances and when you are away from home. The privacy notice allows personalized advertising, sharing with business partners for their own purposes, and use of de-identified data for any purpose.
• Compared with alternatives, Instinct is the most convenient and carries the biggest personal blast radius: one cloud agent with broad live access. Grok Bot offers a training opt-out but no per-Bot isolation, so one poisoned file spreads across Bots. Self-hosted OpenClaw keeps gateway, tools and memory local but carries an RCE bug (CVE-2026-25253) and risky community skills.
• If it goes wrong the recourse is a $100 liability cap and private arbitration, with no class action.

What to do

1. 1Least privilege: connect the minimum, prefer read-only, and use personal rather than work accounts. On Google's consent screen untick every scope you can, and never connect a work inbox.
2. 2Scope Drive to a single folder if offered rather than all files, and grant read-only calendar access.
3. 3For iMessage, grant only the single toggle it needs, avoid Full Disk Access, and turn it off when idle (Mac: System Settings > Privacy & Security).
4. 4For WhatsApp, check Linked Devices often, log out anything unfamiliar, and keep sensitive chats off it.
5. 5Set location to "While Using" or off, never "Always" unless a task needs it right then.
6. 6For logins and payment, use a low-limit or virtual card with a hard limit set on the card itself, never share 2FA codes, and require approval per payment.
7. 7Least agency: sending, paying, deleting and posting should each need explicit human approval, and keep every permission low enough that a runaway agent cannot do lasting damage.
8. 8Bookmark and review monthly: myaccount.google.com/connections, WhatsApp > Settings > Linked Devices, iPhone/iPad > Settings > Privacy & Security, Mac > System Settings > Privacy & Security.
9. 9Using it for work? Loop in security and legal before any pilot and ask about data residency, retention and subprocessors. Most security teams would say "not yet" for anything touching company data.

Indicators

Sources