What Instinct Is Trying to Be
Instinct, a startup founded by ex‑Google engineers, launched a beta of its “AI‑first” personal assistant last month. The service is marketed as a single‑click interface that can read emails, schedule meetings, write code, and even execute transactions on a user’s behalf, all through natural‑language prompts.
Key features highlighted by testers
- Context‑aware code generation that can pull from a developer’s private repositories.
- Automated workflow creation across Slack, GitHub, and cloud dashboards.
- “Delegated actions” that let the assistant place orders, approve expenses, or modify DNS records without manual confirmation.
The Privacy and Security Red Flags
Behind the hype lies a set of permissions that give Instinct near‑full control over a user’s digital footprint. During the beta, the company’s Terms of Service granted the assistant “broad, perpetual access to all data stored in linked accounts” and the right to “act on behalf of the user for any service that supports API integration.”
Security researchers who examined the beta discovered:
- Unencrypted storage of OAuth tokens on the client side.
- Broad scopes such as read/write all files on Google Drive, full mailbox access on Outlook, and admin‑level control on AWS accounts.
- Absence of a granular consent UI; users must accept a monolithic permission bundle.
| Permission | Potential Risk |
|---|---|
| Read/write all files | Data exfiltration, ransomware insertion |
| Full email access | Phishing, corporate espionage |
| Admin API control | Infrastructure takeover, credential leakage |
Why It Matters to the Developer Community
Instinct is not just another chatbot; it is positioned as an “agent” that can execute code and modify production environments without a human in the loop. For developers who live by the principle of least privilege, handing over such sweeping authority contradicts best practices and opens a new attack surface. The assistant’s ability to auto‑generate and push code also blurs the line between suggestion and deployment, raising questions about auditability and compliance.
What Founders and Engineers Should Do Now
Before integrating Instinct—or any AI assistant that offers “delegated actions”—teams should adopt a risk‑first checklist:
- Audit scopes. Review the exact OAuth scopes requested and reject any that exceed the functional need.
- Isolate credentials. Use service accounts with limited permissions and rotate keys regularly.
- Implement a manual approval gate. Require a second factor or human sign‑off before the assistant can execute write‑operations in production.
- Monitor audit logs. Set up real‑time alerts for any API call that originates from Instinct’s client IDs.
- Legal review. Ensure the Terms of Service do not grant the provider ownership or indefinite retention of your data.
Looking Ahead
Instinct’s ambition to become a universal AI proxy is technically impressive, but the trade‑off between convenience and control is stark. As AI assistants move from answering questions to performing actions, the industry will need clearer standards for consent, revocation, and accountability. Developers who adopt early must treat these tools as powerful libraries—subject to the same security reviews, testing pipelines, and governance policies as any other dependency.