Instinct’s $2.5 Billion Raise Still Binds the User as Agent

Instinct closed a $250 million Series B at a $2.5 billion valuation on August 26, the same day it rewrote the terms that govern its invite-only assistant. Spear Street Technology still lets the bot text and call on a user’s behalf, and it still names itself as the party that can bind that user to deals.

Index Ventures and Benchmark co-led the round, taking total funding to $350 million. Founder Noah Shinn is 23, and the product is not public. The people already inside it are.

The Assistant Is Appointed as Your Agent

Instinct is a personal assistant you reach by text or call. Users connect email, messaging, calendars, and other accounts, then ask it to move through the chores they would rather skip, from groceries and tickets to cancelled subscriptions. Shinn said early testers have planned cross-country road trips and that someone is planning a wedding with it.

The live contract is more specific than that pitch. In the terms last revised on August 26, 2026, Spear Street Technology, Inc. doing business as Instinct tells users they authorize the service to access connected apps, copy and index data from them, and take actions the assistant “may deem are responsive” to an input, including purchases. Then comes the line that outlasted the viral screenshots.

You hereby appoint the Services as your agent to enter into agreements, commitments or transactions on your behalf or confirm your acceptance to the terms and conditions of any such third party service or application that the Services interact with on your behalf as part of such Actions. Any such agreements or commitments shall be binding on you as if entered into directly by you.

Spear Street Technology, Terms of Service, last revised August 26, 2026

Those appoint the service as your agent sentences sit next to a risk shift that is just as plain. The company says the assistant is “merely facilitating” a purchase, that the user (not Instinct) is the buyer, and that fights over fees, shipping, or refunds are between the user and the other company. Users also agree they are responsible for every financial, contractual, legal, and reputational result of an action, and that records of those actions “may not always be accurate.”

Safeguards “may” exist. The terms make no promise they will stop a bad send or a wrong charge. The user is told to add extra limits on each connected app and to watch what the bot does.

What the August Terms Still Let Instinct Keep

Testers had circulated a broader grant, a perpetual and irrevocable license to host, copy, publish, and change user materials, including for model training. That phrasing is gone from the page now live. Lawyers have long argued that why sites demand perpetual licenses is often a copyright shield, not a secret sale of private mail, but the screenshots still did their work. Instinct cut the famous words and left the powers that make the assistant useful.

Materials, meaning inputs and outputs, may still be used “to develop, provide, maintain and improve” the product, “including training AI models,” unless a user opts out at app.instinct.co/settings or parks files in a feature called the Vault. Vault items are used only to serve that user and are not used to train. The opt-out is go-forward only. Models already trained on a person’s materials stay trained, and anything flagged for safety review can still be used to teach the system how to spot harm.

THE AUGUST 26 CONTRACT

The privacy policy, also last revised on August 26, 2026, is direct about the sensitive layer. Depending on the permissions a person grants, the assistant may see message and email content, take audio if that feature is on, and use precise location if it is shared. It may receive passwords so it can sign in to other accounts and complete tasks, and it may handle health-related material when it books a medical visit or summarizes a note from a clinic. Instinct says it does not sell information to data brokers.

Usage data collected on the product itself includes keystrokes, clicks, cursor positions, and time on a page. That is narrower than the older claim that the terms harvested every screen on the device, and it is still a log of how a person drives an agent that can spend money.

Four Testers Found the Same Hole

The rewrite did not come from a quiet legal review. In the days before the round was disclosed, people who already used the assistant posted what it did when they pulled on the permissions.

FOUR GAPS TESTERS LOGGED

• Claire Vo: She disconnected Google at 11 a.m. and still received an inbox summary at 2 p.m.; when she asked the bot what had happened, it said the mail was stored in plain text for later searches.
• Peter Yang: The AI writer said Instinct would not delete Gmail records he had already indexed, then said the team added a control for deleting external data after he flagged it.
• Alex Cohen: The Hello Patient co-founder mailed his own inbox a set of hidden instructions, watched the assistant follow them, and deleted his account.
• Katie Jacobs Stanton: The Moxxie Ventures founder said the assistant sent an email on her behalf without checking first, then disconnected email access.

Yang put the deletion fight in one line: “Hey Instinct, it’s not cool to index and retain my emails without my permission and not let me delete them from your records?” Stanton kept using the product for personal chores until that send, then wrote the sentence that still maps onto the August 26 agency clause.

The more powerful these agents become, the more trust matters. Every successful action earns a little more trust. One unauthorized action can reset that trust to zero.

Katie Jacobs Stanton, founder, Moxxie Ventures

Instinct said it was taking the security concerns seriously. The live terms now point users who want indexed connected-service data removed to app.instinct.co/workspace, and they still warn that disconnecting is not the same act as deleting. Users must also promise they already have every consent needed for the inputs they make available, including mail and files that other people created.

Index and Benchmark Priced an Invite-Only Beta

The money arrived on the same calendar day as the new documents. Shinn disclosed a Series B co-led by Index Ventures and Benchmark, a $250 million check on a $2.5 billion valuation, bringing cash raised to $350 million. That leaves $100 million raised before this round. Earlier backers named around the company include Kleiner Perkins, Conviction, and Greenoaks.

California corporate filings list Spear Street Technology as the legal entity, registered in April by Shinn, a former research scientist at Sierra. The public site still asks new people to join a waitlist or obtain an invite. There is no public price. Users must be 18.

THE WEEK THE ROUND LANDED

1. August 20, 2026: The acceptable use policy is last revised, days before the terms page.
2. August 21 to 22, 2026: Testers post the retained-mail, prompt-injection, and unapproved-send cases.
3. August 24, 2026: The permission fight is written up in public, while the company is still invite-only.
4. August 26, 2026: Terms and the privacy policy are last revised, and the Series B is disclosed.
5. September 1, 2026: Shinn says a 12-hour load spike made replies 3-5x slower, then posts personal invite links once capacity is back.

He used the disclosure day to talk about chores, not clauses. “I’m thrilled with everything our early users are doing with Instinct,” he wrote. “They’ve told us they’ve planned cross-country road trips, bought weekly groceries and concert tickets, and cancelled hundreds of dollars of subscriptions. Someone’s even planning their wedding with Instinct.”

I’m Noah, the founder of Instinct.

Instinct is a personal agent that we’ve been building for the past few months. The interface is simple: there are no new interfaces. You can text or call it. It's trained to use a phone and a computer in the same way that humans do. Instinct…

— Noah Shinn (@noahrshinn) August 26, 2026

The product those users describe is not a chat window that drafts a to-do list. In one five-day stretch, an early tester had it fill podiatrist paperwork, cut a cable bill, negotiate wedding merch on WhatsApp overnight, book retreat slots by emailing a hotel from his account, file a DMV appointment, cancel Amazon Subscribe and Save orders, link two United tickets, and pay a toll from a photo. Rival labs already ship tool-use that can attempt the same list. Instinct’s edge is that it keeps going without a confirmation prompt at every step, which is also how an unapproved email gets out.

Who Gets Copied When You Connect Gmail

The overlooked party is not only the person who tapped Connect. It is everyone who already sits in that inbox, that WhatsApp thread, that calendar invite. The terms make the user warrant they have “all rights, licenses, consents, permissions, power and/or authority” to hand those materials over. A wedding vendor in another country, a clinic, a colleague, or a child copied on a family thread never signed Spear Street’s contract.

Google is the one corridor with a hard outer wall. If a user links Google Workspace, Instinct receives Calendar, Gmail, Drive, Docs, Sheets, Slides, and Tasks, and it says that feed will not be used to train or improve models, serve ads, or go to data brokers. That tracks the Google Limited Use requirements that bind any app pulling those scopes. The same documents do not write an equal carve-out for Microsoft mail, iMessage, WhatsApp, screen-side usage logs, audio, or location. Disconnecting a Google link still does not, by itself, erase what was already copied; deletion is a separate request.

The acceptable use policy, last revised on August 20, 2026, tells users not to collect or infer private facts about other people unless they have the rights the law requires. The assistant’s job, once Gmail is on, is to read those people. Instinct also warns, in the privacy policy, that the bot is not a financial, legal, or medical adviser, even as the agency clause lets it book a clinic visit or push a payment through someone else’s checkout.

Disputes with the company go to binding individual arbitration, with a class-action waiver, unless a user opts out as Section 10 of the terms explains. Third-party model providers may process data to keep the assistant running. Deidentified information, the policy says, may be used for any purpose.

Large consumer platforms already hold more of this context than a year-old invite list. They also employ the lawyers and live under the consent orders that make this exact design expensive. A small company can ask for passwords, send mail, and bind a user to a reservation because the people who said yes are still a private cohort, and because the contract puts the downstream harm on them.

Shinn Already Measured How Agents Fail

Before Spear Street, Shinn co-authored a benchmark for tool-agent-user interaction posted on June 17, 2024, while he was at Sierra. Tau-bench tests whether an agent can talk to a user, call tools, and still follow domain rules. Even strong function-calling systems succeeded on under 50 percent of the tasks, and they were inconsistent; pass^8 sat under 25 percent in the retail setting. The paper’s own conclusion was that agents need to act more consistently and follow rules more reliably before they are turned loose.

Instinct is that research moved into a kitchen and an inbox. The terms admit the assistant “may generate Output containing incorrect or incomplete information or make errors in its Actions,” and they tell the user to verify before relying on it. They also let those actions stand as the user’s own. The person who now holds the pen is not Index or Benchmark. It is whoever already granted screen, mail, and card access so the bot could feel, in testers’ words, like something you employ.

On September 1, 2026, Shinn said the team had a 12-hour window two days earlier when replies ran 3-5x slower under load, then brought more capacity online and posted a personal invite link “until we hit the capacity limit.”

Two days ago, we had a 12 hour window during which responses were 3-5x slower due to increased load on our platform. We take these issues very seriously and will do our best to make sure it doesn’t happen again as we scale.

We’ve resolved the remaining bottlenecks over the last…

— Noah Shinn (@noahrshinn) September 1, 2026

New names can still walk in through that link. The documents that name them as the agent of record are the ones dated August 26, 2026.