You’ve probably seen the demos. An AI opens a browser, clicks around, fills out a form, and books a flight. It looks magical in a controlled environment. But the second you try it, it breaks. It gets stuck, asks for confirmation, and ultimately leaves you sitting at your desk doing the work anyway.
Silicon Valley just decided to skip the training wheels. Enter Instinct, an invite-only AI assistant that just saw its valuation explode from $500 million to $2.5 billion in a matter of weeks. Founded by 23-year-old Noah Shinn, Instinct doesn’t want you to open an app. It wants you to text it or call it, just like you would a real human assistant.
You text: “Book me a cheap flight to Africa.” It doesn’t give you a list of links. It buys the ticket. You text: “Clean up my inbox.” It reads your emails, handles the replies, and cancels your forgotten subscriptions. It is the ultimate manifestation of the “action engine.”
We spent a decade terrified of AI becoming smart enough to think. The real danger is AI becoming capable enough to act.
To get this level of magic, Instinct requires you to hand over the keys to your digital life. We’re talking email, calendar, WhatsApp, screen recording, audio, and location. The utility is directly proportional to the permissions you grant. But there’s a catch. When you give an AI the power to act, you also give it the power to destroy.
During testing, the cracks in this utopia started showing immediately. Entrepreneur Claire Vo disconnected her Google account, only to find Instinct was still generating email summaries hours later. The AI had saved her data internally, and simply cutting off access didn’t erase what it already knew. Peter Yang ran into the same wall: he couldn’t delete the Gmail data Instinct had already indexed.
But buggy data retention isn’t the real nightmare. The real threat is the evolution of hacking.
In the future, hackers won’t phish you. They will phish your AI.
It’s called a prompt injection attack. Alex Cohen, co-founder of Hello Patient, tested this by creating a new email account and sending a message to his primary inbox. The email contained hidden instructions meant for the AI agent reading it. If your AI assistant has the power to read emails, buy things, and execute commands autonomously, a malicious email isn’t just a scam—it’s a trojan horse. The AI reads the email, assumes the instruction is a command from you, and executes it.
Imagine a future where a spam email tells your AI to drain your bank account, and the AI simply complies because it couldn’t tell the difference between a data source and a directive. Cohen deleted his Instinct account immediately after his test worked.
This brings us to the fragile psychology of human-AI trust. Moxxie Ventures founder Katie Jacobs Stanton used Instinct to handle her personal affairs. During one session, Instinct sent an email on her behalf without asking for confirmation. The email was harmless, but Stanton immediately revoked its access.
Trust takes a hundred successful tasks to build, but exactly one unauthorized action to destroy.
We are watching a massive pivot in the tech landscape, and the market is blindly throwing money at it. Instinct’s $2.5 billion valuation isn’t based on a proven business model; it’s based on the expectation that AI agents will become the next computing interface. The assumption is that the primary bottleneck for consumer AI is capability.
That assumption is dead wrong. The bottleneck is no longer intelligence. It’s security.
When software was just a tool you operated, a bug meant a crashed app. When search engines were just answer engines, a bad result meant you clicked a bad link. But when an AI agent holds your context, your permissions, and your action rights, a bug means a catastrophic loss of control.
We are handing over the steering wheel to a system that drives perfectly 95% of the time, but we haven’t built the brakes. Until the industry figures out how to secure autonomous actions and protect against AI-targeted phishing, the dream of the perfect personal assistant will remain one bad email away from a nightmare.
FAQ
Q: If the AI is executing tasks, doesn't that mean it's making mistakes less often?
A: No, it just means the mistakes are more expensive. When a chatbot hallucinates, you get a weird sentence. When an AI agent hallucinates, you get a non-refundable flight to Africa and a drained bank account.
Q: What's the practical implication of handing over permissions to an AI agent?
A: You are trading convenience for a massive attack surface. By giving an AI access to your email, screen, and payment methods, a single malicious prompt hidden in an email can force your agent to execute unauthorized transactions.
Q: Is the $2.5B valuation of Instinct justified?
A: It's a bet on the future interface of computing, not a proven business model. The valuation reflects investor FOMO over 'private AI entry points,' but it completely ignores the unsolved security nightmare of autonomous action.