Instinct’s billion-dollar trust fall: your inbox is the landing pad

An AI agent promises to know you well enough to run your life. Before you hand it the keys, ask who gets to keep a copy.

Instinct has announced a $1 billion funding round at a reported $10 billion valuation. A billion dollars is a remarkable vote of confidence from investors. It is not a privacy audit, a revenue figure, or a reason to grant a startup access to your inbox.

Yet this is the new sales pitch: connect your email, your messages, your calendar, perhaps your screen, audio and location. Let the agent see enough of your life that it can anticipate what you need. Congratulations: you have replaced the exhausting task of remembering things with the relaxing task of trusting an organization you barely know with an unusually detailed map of yourself.

To be fair, Instinct does not require every user to hand over all their data. Its access depends on the permissions you grant. But the product’s appeal grows with the breadth of those permissions. The frictionless future has an onboarding checklist, and every checked box widens the blast radius if something goes wrong.

The number nobody should confuse with revenue

The company has announced $1 billion in new financing. Its publicly reported valuation is $10 billion. I could not verify a public revenue number. No publicly disclosed revenue is not the same as zero revenue. Likewise, a valuation is a price investors agreed to pay for a slice of a private company, not evidence that its customers have paid a comparable sum.

Nor is it quite right to say there is no business model. Instinct’s founder has described a model in which the agent remains free to users and merchants pay when it drives transactions. What remains unclear publicly is the economics: what fees, at what scale, with what incentives for the agent that is supposedly working for you? A reported volume of purchases flowing through an agent is not the agent’s revenue. If the assistant is rewarded when you buy, the user deserves to know when a recommendation is advice and when it is a checkout lane.

This is where the irony sharpens. The business needs intimate context to be useful. The prospective commerce model needs influence over choices to earn money. Those two facts do not prove misconduct. They do create a conflict worth examining before giving it access, not after your personal life has become the training ground for an experiment in monetization.

“It can read my email” is also “it can read their email”

Your inbox is not solely yours. It contains messages from friends, colleagues, clients, doctors and people who did not sign up for your AI experiment. Calendar events reveal other people’s schedules. A screen can display a password reset, a bank balance or an internal document. Voice and location can make the portrait more intimate still.

A service can have a privacy policy and still pose a serious trust decision. The relevant questions are concrete: Which systems can it read? Can it send or purchase on your behalf? What is retained, for how long, and by whom? Does disconnecting stop future access only, or also delete copies already collected? Which contractors or models process the data? How would a compromised account or a malicious instruction hidden in an email be contained?

An agent that reads untrusted content and holds privileged access is a particularly consequential design. An email is not a command from you merely because your assistant saw it. A system that blurs those boundaries can turn someone else’s words into actions under your name. That risk exists whether or not the company behind the assistant means well.

Trust is not a feature you can ship later

None of this means personal agents are inherently foolish. It means “give us everything and we’ll figure out the rest” should not pass for a privacy strategy. Start with the narrowest permissions. Demand meaningful data deletion and a clear account of retention. Look for independent security evidence, boundaries between reading and acting, and an explanation of who pays for recommendations. If you cannot get satisfactory answers, do not connect the account that contains your life.

Instinct’s billion-dollar raise tells us what investors are willing to risk. Your inbox, conversations and relationships tell us what you would be risking. Investors can diversify. You cannot diversify your private history.

Sources and fact-checking

• Instinct privacy policy and product site for the scope of connected data and permissions.
• Funding announcement for the $1 billion Series C and reported $10 billion valuation.
• TechCrunch on the founder’s reported transaction volume for the distinction between transaction volume and company revenue.
• TechCrunch on security and privacy concerns for independent reporting on the product’s risk profile.

Editorial note: Revenue, fees and retention practices may change; verify current disclosures before publication.