AI Assistant Instinct Keeps Your Emails After You Disconnect It, Testers Say

An AI assistant called Instinct is currently invite-only, but it's already generating the kind of buzz and backlash normally reserved for products with millions of users.

Instinct is built by Spear Street Technology, a San Francisco startup led by former Sierra research scientist Noah Shinn, according to TechCrunch. You text it. It handles your life: booking doctors, canceling subscriptions, negotiating your cable bill, planning your brother's bachelor party. Investor Sheel Mohnot posted on X that he exchanged 677 messages with it in five days and had it cut his Comcast bill from $100 a month to $60. He called it "OpenClaw for normal people."

The Terms of Service Are Broad. Very Broad.

Screenshots of Instinct's terms of service, circulating on X and reported by both TechCrunch and Bitcoin World, show the company claims a "perpetual and irrevocable" license to "access, use, host, cache, store, reproduce, transmit, display, publish, distribute, and modify" a user's materials, including for AI model training.

The terms also disclose that Instinct can receive screen captures, cursor movements, and keyboard inputs. And per those same reports, the agent can enter into agreements and transactions on the user's behalf that are legally binding.

The document says exactly that, according to the screenshots reviewed by TechCrunch and Bitcoin World.

Disconnecting Doesn't Mean Deleting

The incident that turned skepticism into a full backlash involves Claire Vo, a three-time chief product and technology officer and host of the podcast How I AI.

According to reporting from ExplainX.ai, Vo disconnected Instinct from her Google account at 11 a.m. At 2 p.m., she received an email summary anyway. She found 36 Gmail messages still sitting in Instinct's stored records hours after she'd cut the connection, and deleting them required a special request to the company rather than a self-serve option.

Vo, notably, didn't frame this as an attack or a hack. She called herself "a forgiving tester who understands the tradeoffs," per ExplainX.ai, while telling the Instinct team directly that "I'm not sure others will be quite so forgiving." That's a fair distinction to draw. Nobody breached Instinct's systems to get at those 36 messages. The agent did exactly what its architecture allowed: a revoke button stopped new access but left a standing copy of what had already been pulled in.

When asked what happened, Instinct itself confirmed the emails were stored in plain text for later searches, according to TechCrunch.

Other Testers Found Other Problems

Peter Yang said Instinct wouldn't delete his Gmail records when he asked it to, though the company later added a settings tool for deleting external data, per TechCrunch and Bitcoin World.

A separate report from usecarly.com, an analysis site built around a competing product called Carly, says a user planted malicious instructions inside an email and got the agent to send back a summary of the victim's inbox, a textbook prompt injection attack. That report also says Instinct sent an email on a user's behalf without asking first. Bitcoin World identifies that user as Katie Jacobs Stanton, who said the unauthorized email "broke her trust."

Hello Patient co-founder Alex Cohen said that once he understood how easily Instinct could be phished, he deleted his account, according to both TechCrunch and Bitcoin World.

Usecarly.com has a direct commercial stake in this story. It's marketing its own product, Carly, as the safer alternative that doesn't train on customer data. That doesn't make its factual claims false, but readers should weigh the source accordingly.

The Other Side of the Ledger

None of this means Instinct doesn't work. Testers who complained about data retention were often the same people calling the product remarkable. Mohnot's account of automating doctor visits, bill negotiations, and vendor haggling over WhatsApp while he slept is detailed and specific, not vague hype. Product executive Jason Shuman called it the closest thing yet to the assistant people have been waiting for, according to usecarly.com.

The company also appears to respond to complaints. It reportedly added a deletion tool after Peter Yang's Gmail issue, and told at least one tester it would close the email-storage gap quickly, per usecarly.com. Spear Street Technology has not issued a public response to the broader set of incidents, according to a governance analysis published by AI Governance Institute.

What's Actually at Stake

Michael Mignano, founder of Anchor and a general partner at Union Square Ventures, warned that products like Instinct will "change modern security norms for consumers," per Bitcoin World, as people hand over account access to third-party apps without fully grasping what they're agreeing to.

The AI Governance Institute's analysis frames this as a preview of a bigger fight: whether state privacy regulators, including the California Privacy Protection Agency, will treat perpetual AI-training data licenses as an unfair or deceptive practice under existing consumer protection law. No investigation or enforcement action has been announced. That's a live regulatory question, not a settled one.

Instinct remains invite-only. Ian Kar, another early observer, asked pointedly on X whether any non-VC has actually used the product yet, a fair jab given how insider-heavy the early access pool looks for a product already being described in magic terms, per ExplainX.ai. Whether Instinct tightens its data practices before a wider rollout, or whether regulators force the issue first, is the open question hanging over the entire personal-AI-agent category right now.