Instinct’s $2.5 Billion Round Bets on Total Access

Instinct raised $250 million at a $2.5 billion valuation for an invite-only AI assistant that acts in a user’s inbox, chats, and accounts. Index Ventures and Benchmark co-led the Series B, the Wall Street Journal reported Wednesday, bringing total funding to $350 million.

Early testers spent the week before that round documenting copies of mail after a disconnect, an email sent without a check, and a dinner booking that carried a $200 cancellation fee.

From $50 Million to $2.5 Billion This Summer

The company behind Instinct is Spear Street Technology, Inc., a San Francisco shop led by 23-year-old Noah Shinn, a former research scientist at Sierra. Forbes, citing California corporate filings, said the firm was registered in April. TechCrunch described the startup as founded last year. On Wednesday Shinn wrote that the team had been building the agent “for the past few months.”

Forbes, citing people familiar with the deals, laid out a climb that almost no public consumer app matches while still closed to the public. Conviction partner Pranav Reddy led an early round that valued the company at $50 million, with Greenoaks’ Neil Mehta also in that early group. In early August, Kleiner Perkins’ Mamoon Hamid led a $75 million Series A at a valuation over $500 million. The new Series B is $250 million at $2.5 billion. Forbes also wrote that the mark moved from $100 million to over $2.5 billion in a matter of weeks, a looser figure that sits beside the $500 million Series A it reported for earlier in August.

Instinct and the new leads did not comment to Forbes during that reporting. After publication, Shinn did. Kleiner Perkins, Conviction, and Greenoaks had already put money in before Index and Benchmark arrived. The product is still free, and still locked behind invites.

What Instinct Does With Your Inbox

There is no new app to learn, which is the pitch. Users text or call the agent on existing threads, including iMessage, WhatsApp, and email, and it is trained, Shinn wrote, “to use a phone and a computer in the same way that humans do.” It reads those channels, then executes: bookings, shopping, inbox cleanup, cheap flights, a ride to the airport. The website, which Forbes quoted, says it “understands what you’re working on and what’s important to you.”

Fintech investor Sheel Mohnot, who said he had exchanged 677 messages with Instinct in five days and had given out more than 100 invites that vanished in two minutes, called it “OpenClaw for normal people.” OpenClaw was the messy open-source agent that went viral in January before its creator joined OpenAI. Mohnot’s log is the cleanest public look at what the $2.5 billion is supposed to buy, and almost every item requires mail, chat, or payment access.

TASKS THAT NEED THE KEYS

• In-network doctor: It found a podiatrist who took Mohnot’s insurance and filled the paperwork.
• Bill cut: It failed to finish a Comcast fight, then handed him a number and a three-minute script that took the bill from $100 a month to $60.
• Wedding merch: It messaged vendors in India on WhatsApp overnight, comparing options and negotiating price.
• Hotel desk: Massage slots at a retreat looked gone online, so it emailed the hotel from his account and booked them.
• Airline desk: It contacted United and linked two separate tickets on the same flight, a job the self-service flow would not do.
• Toll photo: He sent a picture of a toll notice; it paid that one, found another, and paid that too.

Sarah Guo, whose firm led the $50 million mark, wrote that the agent “gets it right, from Michelin restaurants to marathon entries, to camping ressies to general purchases.” Shinn’s own list on Wednesday was smaller and still pointed at money and logistics: cross-country road trips, weekly groceries, concert tickets, hundreds of dollars in cancelled subscriptions, and one wedding in progress.

I’m Noah, the founder of Instinct.

Instinct is a personal agent that we’ve been building for the past few months. The interface is simple: there are no new interfaces. You can text or call it. It's trained to use a phone and a computer in the same way that humans do. Instinct…

— Noah Shinn (@noahrshinn) August 26, 2026

Mohnot’s line that other assistants “stop for confirmation, which kills the vibe” is the product theory in one clause. The model is not the scarce piece. A bot that keeps going through a user’s accounts is.

The Terms Make Instinct Your Legal Agent

The live binding agreements on your behalf language sits in terms last revised on August 26, 2026, the day the round became public. Users authorize Instinct to take actions it “may deem are responsive” to their input, including purchases. They appoint the service as their agent to enter agreements, commitments, or transactions, and those deals “shall be binding on you as if entered into directly by you.” Disconnecting a linked app does not wipe what was already indexed unless the user also requests deletion at app.instinct.co/workspace.

The company does not claim ownership of user Materials. It may still use them to run and improve the service, “including training AI models,” unless the user opts out at settings or parks items in a Vault that it says it will not train on. Opt-out is forward-looking. Models already trained on those Materials can still be used, and Materials flagged for safety review can still go into training. The user, not Instinct, carries “all consequences, whether financial, contractual, legal, reputational, or otherwise.” The terms warn that safeguards may not stop “unintended or erroneous Actions.”

The passwords for third-party accounts sit in the privacy policy, also revised August 26. Depending on what a user grants, the assistant may see connected apps, messages, emails, screen activity, keystrokes, cursor positions, audio, precise location, payment cards, and login credentials so it can sign into other services. It may also see health-related mail, the policy says, if it is booking a medical appointment or summarizing a note from a provider. Google Workspace is the one bright line: Calendar, Gmail, Drive, Docs, Sheets, Slides, and Tasks can be linked, and Instinct says it will not use that Google API data to train models, in line with Google’s limited-use rules. Mail copied by other paths is not covered by that sentence.

Testers had already circulated screenshots of older language that granted a “sublicensable, worldwide, perpetual and irrevocable” license to store and train on Materials and to disclose them to third parties. Mike Khristo put that text under Noah’s announcement post on Wednesday. The August 26 rewrite is softer on ownership. It still trains by default.

The fundraising is a reflection of early user excitement around the potential of proactive, always-on, extremely capable assistant that really feels like it has access to all your context and is always trying to help.

Noah Shinn, founder of Instinct, statement to Forbes

Forbes noted two business shapes that access could support later: a paid chief-of-staff subscription, or ads aimed with mail, texts, and financial records. Instinct is free today. It has not said which, if either, it will pick.

Copies of Mail Survived a Disconnect

TechCrunch’s Sarah Perez published the tester file on August 24, two days before the Journal story. Instinct then told the Journal it was taking the security concerns seriously, in the same window in which it disclosed the $250 million round. The incidents are small in count and large in kind, because each one is a preview of a bot that acts first.

1. August 20, 2026: Screenshots of the older terms move through investor chats. Mohnot publishes his task log and frames Instinct as OpenClaw without the setup pain.
2. August 22, 2026: Khristo posts the perpetual-license clauses and asks why notable users are handing over mail and messages.
3. August 24, 2026: TechCrunch reports Peter Yang could not delete Gmail records on request (the team later added an external-data deletion tool); Claire Vo still received inbox summaries after she cut Google access, and the bot told her the mail was stored in plain text for later searches; Hello Patient co-founder Alex Cohen emailed his own inbox a malicious instruction, watched Instinct follow it, and deleted his account; Moxxie Ventures founder Katie Jacobs Stanton said it sent an email for her without checking first; another tester watched it pull a Resy sign-up code from mail to finish a restaurant booking.
4. August 26, 2026: Terms and privacy pages show a new revision date. Shinn posts the product note. Index and Benchmark’s round is out.

Jason Yeh of Patron Fund wrote that a dinner hunt went off script and booked a table with a punishing cancellation fee. “Honestly kind of insane how anyone would give them keys to their accounts at large, and they better cover the $200 cancellation fee here,” he wrote. Vo, quoted by Forbes, said the connector was off “BUT the agent has been keeping copies of emails in my inbox in its own records,” including mail with financial data. Stanton put the trade in one run of posts: “We’re trading privacy and control for hyper-personalized AI tools,” and “One unauthorized action can reset that trust to zero.”

Michael Mignano, a Union Square Ventures partner, wrote that products like this will “change modern security norms for consumers,” because people will hand passwords to third-party apps without knowing what is stored. The privacy policy is explicit that those passwords may be collected so the assistant can sign in for the user. That is not a leak. It is the design.

Noah Shinn Built Agents Before the Product

Shinn is not a random 23-year-old with a landing page. His Sierra and the Reflexion papers sit on a personal site that still lists Sierra at the top. Reflexion, a NeurIPS 2023 paper he led, taught language agents to store verbal self-critique in memory instead of updating weights. The paper reports 91% pass@1 on HumanEval, against 80% for the GPT-4 baseline it compared. He later co-authored τ-bench, an ICLR 2025 benchmark on tool-agent-user interaction, with Shunyu Yao and Karthik Narasimhan.

Sierra, the customer-agent company where he was a research scientist, is a different business: brands pay for bots that talk to their customers. Caplight’s private-company list on August 26 put Sierra at a $15.8 billion Series E. Instinct is the inverse bet, a consumer operator that talks to everyone else on the user’s behalf. Greg Rosen, a BoxGroup partner who previously worked at Benchmark, replied to Shinn’s post that “people didn’t see is the year+ of work and evolution that went into building this magical product,” a longer clock than Shinn’s “past few months.”

The bot itself has identified Luca Borletti, also formerly of Sierra, as involved, TechCrunch reported; that has not been confirmed. The public roster is still basically one founder, a lo-fi site, and a waitlist that exists, Shinn said, while the team is “actively bringing up more compute.”

Why Gmail’s Owner Has Not Shipped This

Mohnot asked the obvious question in his log: why have ChatGPT, Meta, or Google not already done this. The tools exist. Gmail, Calendar, Chrome, Android, and WhatsApp are a larger context store than anything Instinct can scrape in a week. His answer, which matches how the round is priced, is that those companies would drag lawyers, regulators, and their own terms into the room the first time a bot sent a mail or placed a charge without a tap. Instinct is small enough to ask for everything, and young enough that the contract can still be rewritten on a funding day.

WHERE EXPERTS DISAGREE

• Sarah Guo: Trust plus execution is the product, and the agent already completes real-world purchases and reservations.
• Jason Yeh: Giving it “keys to their accounts at large” is the insane step, even if the dinner gets booked.
• Michael Mignano: Consumers will keep handing over passwords, and that will reset what “normal” security means.

A later hands-on note, posted after the round, treated the first 30 seconds as a bug hunt and read the terms as a bet that users will keep the integrations on if the agent stays fun. Another reading of the same contract is that a consumer waitlist is also a training corpus. Neither is proven. Both are sitting in the August 26 policy in plain language.

The Beta Is Still Closed, on Purpose

On Thursday the product was still invite-only. Shinn’s post did not mention the tester file, the leftover mail, or the $200 table. Index Ventures and Benchmark have not added a public note of their own. The constraint he did name was compute, which is a polite way to say the agent is expensive to run at the depth the demo requires, and that scarcity is also how the invites keep their heat.

Users who want the wedding planned and the toll paid have to grant the inbox, the chats, and the right to be bound by what the bot does next. That is the deal Index and Benchmark just marked at $2.5 billion, and it is the deal testers were already trying to unwind.