Instinct AI: what it publishes, and what it does not

Instinct has raised $350M, which is more than the other 16 funded agents in this directory have raised between them at $180M. Of the 13 things recorded here about who runs a product and what it does with your messages, it publishes 8. The median for a funded listing is 10.

It is not hiding everything, which is the interesting part. It is publishing an ordinary amount while holding an extraordinary amount of money.

The thing people are actually asking

The question turning up around Instinct is not what it does. It is who is behind it. A thread on r/AI_Agents put it as going viral by hiding everything: no team page, no launch, just a waitlist, and a company name that tells you nothing. That reading is close and it is not quite right, and the difference is checkable.

Instinct's front page is one screen. It names no company, no founder and no price, gives a San Francisco line and an address to write to, and says access is by waitlist or an invitation from a member. The company name appears in exactly one place on the entire site: the privacy policy, which went up on 26 August 2026, after the product was already being talked about. That document names Spear Street Technology, Inc. doing business as Instinct.

So the answer to who is behind it has been published. It is published in the one document nobody reads.

What it does publish

Seven of the eight are the things a company says when it wants coverage, and one is not.

It names the operating company, the founder, the raise, the policy and the date on it. It answers the training question, which most of this market does not: conversations train the models unless you opt out in settings, and the opt-out applies going forward, so anything already used stays used. Google Workspace content is carved out entirely.

The eighth is the one worth reading twice. Instinct is the only listing in this directory whose policy describes being handed the password to somebody else's service: you may provide "your username and password for third-party accounts so that the personal assistant can sign into these accounts on your behalf". Sixty-four other products either take a scoped token, take a session you opened yourself, or say nothing at all.

Its policy is also the only one here that names prompt injection, warning about "interactions with third parties who may include misleading instructions intended to influence autonomous agents", alongside the possibility of unintended payments and unintended messages to outside parties. The company that describes holding your password is the same company that describes the attack.

What it does not publish

No retention section and no deletion timetable. No state privacy rights of any kind, in a policy for a United States product. No security contact, so a researcher who found something would be writing to a general address.

Nothing about who runs the model, nobody named for carrying the messages, no jurisdiction, and no number you can text.

Set that against the rest of the funded set. Ollie raised $7.5M and publishes 12 of 13. Orchid publishes 12 and has announced no round at all. Flip raised $1.4M and publishes 11, including a full account of what happens to a password its browser never receives.

The pattern in this market is not that money buys disclosure. It is that the two most thoroughly documented products here are among the smallest, and the best-funded one sits on the median for everybody.

What is not known

Whether any of this is deliberate. A company three months into a private beta with a policy published in August is also a company that has not got to it yet. What is missing has the shape of a second pass: retention, rights, a security contact. Those are what a general counsel adds after the launch, not before it.

The other unknown is heavier. On 10 September a named founder and former investor reported giving Instinct a Verizon login and then receiving an authentication request from Tehran, published the screenshot, deleted the product, and said a message to the company went unanswered. Nothing public establishes what caused it. This page does not say Instinct was breached, and if an explanation arrives it goes on that listing with the same weight as the report.

What to watch

The first is the missing rows. Retention, a deletion timetable, state rights and a security contact are four sentences of work for a company with this much capital, and the day they appear is the day the second-pass reading becomes the right one.

The second is whether the password sentence survives. It is unusual enough that it will be quoted at Instinct repeatedly, and there are four published alternatives in this directory already, one of which never receives a password at all.

Last is whether the company answers anything in public. It has not replied to the account above, its site names nobody, and the only thing it has said about itself in writing is a privacy policy. That is a strategy while the product works, and it is the whole strategy, which is what the people arguing about it on Reddit have got right.