(Mechanism as described by the company and reported outlets. All of the following is COMPANY CLAIM about internal design; none of it is independently audited.)
FACT (about the product's user-facing shape). Instinct ships no mobile app. Users interact by texting or calling a number that belongs to Instinct, over SMS (and, per TechCrunch's August reporting, WhatsApp).
COMPANY CLAIM (mechanism). From instinct.com: Instinct "connects to your applications and devices — email, messaging, screen, audio, location, and more", and "it's trained to use a phone and a computer… It uses its devices in the same way that humans do." The stated design goal is no new interface: the agent operates the user's existing surfaces — screen, audio, keyboard/cursor — rather than exposing an app-shaped API the user must learn.
COMPANY CLAIM (capability surface). The company describes tasks it handles end-to-end: planning a cross-country road trip, ordering weekly groceries, cancelling forgotten subscriptions, arranging an airport ride, booking a handyman, and — via Concierge — places with no online booking at all (restaurant reservations, a dentist's cancellation list, a cable bill).
COMPANY CLAIM (safety architecture). Four named mechanisms: isolated sandboxes, short-lived local credentials, identity-signed tool execution, and an "active detective system" that the release says catches subtle hallucinations while the response is being formed, "cutting them out before Instinct generates or executes a response". Reuters reported the same privacy items in its write-up, which is corroboration that the claims were made, not corroboration that they work.
COMPANY CLAIM (multi-agent layer). The Trusted Person Network is powered by an "Instinct-to-Instinct communication protocol" allowing one user's agent to talk to another user's agent to coordinate plans, with direct file sharing of PDFs, images and spreadsheets.
COMPANY CLAIM (location). Location Sharing, "shared on iMessage", lets the agent recognise arrival somewhere and respond to it.
FACT (policy reality, from Instinct's own terms as summarised by Unite.AI's reading of them). The privacy policy, last revised 2026-08-26, names Spear Street Technology, Inc. as operator and says that depending on permissions, the assistant may reach connected applications, message/email content, audio and voice data, payment information, third-party usernames and passwords, and health-related information. Information may be used to evaluate, fine-tune and train the company's models, with a go-forward opt-out at a settings page — and material flagged for safety review may still be used for training. Data obtained through Google Workspace APIs is stated not to be used for training. The terms frame the product as user Inputs, agent Outputs, and Actions taken on the user's behalf, under which the user appoints the agent to enter binding agreements, commitments and transactions; the terms also state that services are not error-free and that Actions "may not always be reversible".
INDEPENDENT EVIDENCE (this is the load-bearing caveat). Instinct's own privacy policy warns that autonomous agent features can produce unintended actions — including unintended payments or communications to third parties — and that interactions with third parties may contain misleading instructions intended to influence autonomous agents (i.e. prompt injection from third-party content). That is the company conceding, in its own policy, the exact class of risk that independent testers demonstrated in August: Alex Cohen reported that he emailed instructions to a fresh Gmail account and showed that Instinct could be phished via inbox content, and deleted his account; another tester found the agent pulling a sign-up code from the inbox to complete a booking.