Instinct AI is not known to have suffered a data breach, but it asks for more access than most apps and its terms make you responsible for what it does. Testers have reported an email sent without confirmation and data kept after access was revoked, and the company has changed settings in response. Whether it is safe enough depends on which accounts you connect and which actions you let it take without asking.
This article sets out what the privacy policy and terms of service say (both last revised on 26 August 2026), what has been reported and how Instinct responded. It ends with a checklist for individuals and one for companies whose staff may connect work accounts. Facts are as of October 2026. We have not used Instinct; it is invite-only. If you are new to the product, start with What is Instinct AI?.
What data does Instinct collect?
Depending on what you connect, Instinct collects:
- contact details and payment information (through a third-party processor)
- the content of messages, emails and other communications you make accessible
- audio and voice data, if enabled
- Google Workspace data: calendar, email, files and their metadata
- precise location, if you share it
- usage, clickstream, IP, device and log data
You can also give it “your username and password for third-party accounts” so it can sign in for you. Health information may be processed too, for example when it books an appointment or summarises an email from a clinic.
On sharing, the policy says “We do not sell your information”. Data goes to vendors, to “Third-party AI model providers who help support the Services”, to the businesses Instinct deals with on your behalf and to affiliates. The model providers are not named.
On training, Google Workspace data is not used to train AI models. Other data can be. You can opt out at app.instinct.com/settings, but the opt-out applies only from that point on. Data flagged for safety review can still be used, and models already trained are not affected.
Two gaps stand out. The policy does not state retention periods, and it does not mention GDPR or CCPA. For UK and EU users, that means no stated legal basis for processing and no stated route to exercise data subject rights.
What do the Instinct terms say?
The terms cover actions, and that is where the real exposure sits. The central sentence is: “You authorize the Services to take Actions on your behalf.” You appoint Instinct as your agent, and any agreement it enters “shall be binding on you as if entered into directly by you.”
| Topic | What the current terms say |
|---|---|
| Purchases | “You, not us, are making such purchase.” Disputes are between you and the seller |
| Confirmation before acting | The company “may implement safeguards, confirmation requirements, or other controls” but does not promise they will stop erroneous actions |
| Reversibility | “Actions may not always be reversible” |
| Responsibility | You are responsible for your inputs, the actions taken and any output you use |
| Liability cap | The greater of $100 or what you paid in the previous six months |
| Disputes | Individual arbitration with a class-action waiver; opt-out possible within 30 days |
| Account termination | Possible “for any or no reason” |
The licence over your content has changed. TechCrunch quoted the terms in force in August 2026 as granting a “perpetual and irrevocable” licence to use, store, publish and modify user materials, including for AI training, and as allowing screen captures, cursor movements and keyboard inputs to be collected from devices. The version revised on 26 August no longer uses “perpetual” or “irrevocable”, as of our check on 8 October 2026. It still allows your materials to be used to improve the service, including AI training, unless you opt out.
Jeremy Banon told TechCrunch that Instinct was “a hard no” from a security standpoint, yet called its policy “100% forthcoming”. That is a fair summary: the risks are disclosed, and they sit with the user.
What problems have been reported?
August 2026: tester complaints
TechCrunch collected accounts from early testers in late August:
- Peter Yang said Instinct would not delete his Gmail records when asked; it had been indexing and keeping his emails. Instinct later added a setting to delete external data.
- Claire Vo said that hours after she disconnected Google access, Instinct still summarised her inbox. The bot told her the emails were stored in plain text for later search.
- Katie Jacobs Stanton said Instinct sent an email for her without checking first. She disconnected her email.
- Alex Cohen tried to phish the agent by emailing it instructions from a new Gmail account, then deleted his account. He said it is not yet safe to give an AI read and write access to an inbox.
Instinct told the Wall Street Journal it was “taking the security concerns raised seriously”, and Shinn said the company has stopped the agent from taking some actions earlier versions could take (PYMNTS). The OECD AI Incidents Monitor logged the reports.
The Claire Vo case is the most instructive for businesses. The policy states that “disconnecting a third-party integration does not automatically delete data collected from that integration”. Revoking access stops new collection. Deleting what was already indexed is a separate step, at app.instinct.com/workspace.
September 2026: did Instinct leak user data?
On 21 September a user posted screenshots in which Instinct appeared to use someone else’s middle name and discussed a photo of a financial document he said he had never sent. The bot apologised, said the photo “got crossed into” the conversation and called it a “serious glitch” (Business Insider).
Shinn replied on X that it “was caused by a hallucination (the model fabricated a proper noun)” and “was not a data breach, no user data was shared, and no user isolation boundary was violated.” He described data as “truly partitioned” through isolated sandboxes, short-lived local credentials and identity-signed tool execution, and said the team had spent 48 hours building an “active hallucination detection system” able to steer or stop the agent before its next step.
Business Insider noted that Shinn did not explain how the team knew it was a hallucination. No independent party has verified either version. The honest position is that this was neither a confirmed breach nor a confirmed non-breach. It does show a separate problem: the agent itself told a user that another person’s data had crossed into his chat, which, if the company is right, was false. An agent that misreports its own behaviour is harder to investigate.
October 2026: group chat safeguards
With group chats, announced on 5 October, Shinn listed new rules: your agent asks before connecting to a group’s agent, you choose which groups to trust and can revoke that trust, the group agent cannot reach personal accounts, and your agent asks before sharing information or acting (TechCrunch). These are the company’s own claims; no audit or technical documentation was published with them.
Checklist for individuals
If you have an invite, these steps cut most of the risk described above:
- Opt out of AI training at app.instinct.com/settings on day one, since the opt-out does not reach back.
- Connect one account at a time. Start with a calendar, not your main inbox.
- Do not hand over passwords for banking, health or government accounts.
- Ask the agent to check with you before every email, booking and payment, and watch whether it does. The terms do not guarantee it.
- Use a card with a low limit or a virtual card for anything Instinct buys.
- When you disconnect a service, also delete its indexed data at app.instinct.com/workspace.
- Ignore invites sold online or links to instinct.ai; the real site is instinct.com.
- Decide within 30 days whether to opt out of arbitration, by emailing support@instinct.com.
Checklist for companies
The harder question is what happens when an employee connects a work Google Workspace account to a consumer agent. Under the terms, agreements the agent makes bind the user; under your contracts, an email from a staff member’s account may bind the company. The agent may also index client data and pass it to unnamed model providers.
A workable policy, in our view, covers four areas:
- Inventory. Check your Google Workspace or Microsoft 365 admin console for third-party apps with mail, Drive or calendar scopes, and decide which consumer agents are allowed. Personal agents of this kind typically ask for mail, file and calendar access at once.
- Least privilege. If an agent is allowed, grant read-only scopes by default and keep send, delete and payment rights for named, approved cases. Separate personal and work accounts.
- Confirmation steps. Any action that sends external messages, signs up for services, accepts terms or spends money should need a human click. If a tool cannot enforce that technically, a written rule is not enough.
- Offboarding and audit. Revoking OAuth access is not deletion. Your process should include deleting data held by the vendor and keeping a record of what the agent did while connected.
For regulated data (health, finance, personal data of EU residents), the missing GDPR reference and retention periods in Instinct’s policy are, on their own, reason to keep work accounts out for now.
These are the controls we design into the agents we build for businesses: scoped tool access, approval gates on irreversible actions and logs that show who or what did what. If you want help setting a policy or building an internal agent with those controls, our AI consulting and LLM development and consulting teams work on exactly this. For how Instinct’s approach compares with Meta’s and OpenAI’s, see Instinct vs Meta Muse vs ChatGPT Dots.
FAQ
Did Instinct AI leak user data?
It has not been confirmed. In September a user posted screenshots that appeared to show another person’s data; Instinct’s founder said it was a model hallucination, not a breach, and that no user data was shared. Neither explanation has been independently verified.
Does Instinct use my data to train AI?
Google Workspace data is not used for training. Other data may be, unless you opt out in settings, and the opt-out only applies going forward and does not cover data flagged for safety review.
Does disconnecting Gmail delete my data from Instinct?
No. The privacy policy says disconnecting an integration does not automatically delete data already collected. You need to delete indexed data separately at app.instinct.com/workspace.
Can Instinct send emails or make purchases without asking?
The terms allow it to act on your behalf and do not guarantee a confirmation step. One tester reported an email sent without checking first, and Shinn has said some actions were later restricted. For group chats, the company says the agent always asks before sharing or acting.
Should employees connect work accounts to Instinct?
Not without an explicit company policy. The service has no stated GDPR basis or retention periods, shares data with unnamed AI model providers, and binds the user to agreements the agent makes.
Bottom line
Instinct is open about the trade it asks for: broad access and full responsibility in exchange for an assistant that gets things done. For company email and client data, the controls should sit with the company, not with the agent’s default settings. AI Superior helps businesses design those controls and build agents that work within them.