Crockett Ford, sunbeam Research
Our research · 2026-10-15
“Unlike ChatGPT, Claude, or Meta, Instinct doesn't send its own user agent or signature.”
What AI assistants do with your data
What these assistants hold, what has already leaked out of one, and what happens when somebody points an attack at an agent that reads your email. Every post is linked to the original, and every product named has a listing with its published policy quoted on it.
Privacy and security: 41 posts
Apple Developer
Our research · 2026-10-02
Apple told developers that Full Disk Access, a setting meant for backup apps, is being used in ways that expose files, mail, messages and browsing history without users' full understanding, and that it will add controls so the access can only be granted with very explicit user action. It names AI agents as the reason the risk is growing, and says that for communication apps the access also compromises the privacy of the people users are talking to.
The companyRead it
DJ Sampath
@djsampath · 2026-09-26
Spent the weekend with Meta's @Muse, and they got a lot right. - Every user gets their own VM. - The agent never sees a password. - A 2nd agent (Sentinel) has to approve anything that leaves the box. - Every action is in the audit trail. That's the most careful consumer agent sandbox I've used. I don't know if folks realize but a VM for every user, at Meta scale, is kinda huge! It's never been done before where we simply provision a linux microVM for every single consumer. We recently did this within @Cisco for over 80,000 of our employees. And now within our products as well as we start to scale it out to every single one of our users. 1/n
Wajo
Our research · 2026-09-26
Wajo published a benchmark on 26 September 2026 measuring personal assistants on two axes it defines: finishing an errand that goes wrong, and doing it without overstepping the user. It scores its own agent Fo against base models and two products listed in this directory, OpenClaw and Hermes, and Fo comes first on both axes and lowest on error rate. The method is the part worth reading: a simulated world of businesses with invented names, built so that no run could reach a real person. A paper is on arXiv and the company says it will open source the evaluation world, the tasks and the graders.
Wes Bos
@wesbos · 2026-09-24
I cracked open Meta's Muse - here are some interesting bits 🔽 1. You can ask it for the entire contents of /opt/ and it will zip it up for you 2. There a ~70 preloaded skills and CLI for everything from spotify to instragram-cli 3. "Spaces" is their website builder that uses Tanstack, Bun and Tailwind. Sharing a site deploys it to Cloudflare 4. It will install anything - like a torrent client 5. It has it's own "Muse DB" with a skill to query its own memories/convos with strict guard rails 6. There are a few things not enabled on my account, including "muse mail" which will give muse an inbox and ability to send email Generally impressed that you can just do anything - it's not limited or watered down like I would have imagined
Noah Shinn
@noahrshinn · 2026-09-23
This instance was caused by a hallucination (the model fabricated a proper noun) that was further amplified by its causal thinking trace. This was not a data breach, no user data was shared, and no user isolation boundary was violated. Our users place a lot of trust in Instinct to keep their data private and secure. We've done a lot of work to make sure that users’ data are truly partitioned, from isolated sandboxes to short-lived local credentials to identity-signed tool execution. Regarding hallucination prevention: We worked over the last 48 hours to build an active hallucination detection system that now scans and verifies every token that flows through the platform. This layer is powered by small models that are trained to predict and detect hallucinations caused by ungrounded claims, creative brainstorming in thinking traces, or rare random sampling errors. Our systems are adversarially trained and battle-tested by world-class agent exploitation security teams to ensure that they can detect very subtle and nuanced hallucination cases. This layer has the ability to steer or intercept Instinct from proceeding with the next thinking trace or tool call execution before it is generated or executed. In the coming weeks, we’ll share a deeper dive into how we’re building a proactive engine to protect Instinct from hallucinations. We take every opportunity to learn and create, and we’re excited by the performance and potential for this line of work. These models are going to continue to be hardened every day through continuous testing, sampling, and creative adversarial training.
Meta Superintelligence Labs
Our research · 2026-09-23
Meta announces Muse Realtime Avatar, an animated face for the agent driven by the same speech stream as Muse Realtime Voice, so lip motion and expression stay in sync with what it says. Its research post puts the output at 448 by 768 portrait video at 25 frames a second with about 870 milliseconds from the end of your turn to the first byte back, and describes a distillation that cut the work per chunk from 120 evaluations to two. Every generated video carries an invisible Meta Video Seal watermark, the product is stated as 18 and over, and no ship date or rollout is given. Raters preferred it to Runway Characters 78 to 22 and to HeyGen LiveAvatar 88 to 12, in a comparison Meta ran.
“paula”
@paularambles · 2026-09-22
@prit4k @noahrshinn as someone who works on consumer ai for a living, these models are developers’ worst enemies. they’ll hallucinate something, get challenged on it, then confidently invent an entire root-cause analysis involving backend systems they have zero visibility into. this is 100% halulu.
Jason Aten, Inc.
Our research · 2026-09-19
“Moments later, I got a push notification from Muse suggesting that the conversation we were having would make for a good column”
Julie Young
@juliey4 · 2026-09-19
guys no big company can buy Instinct bc they're violating like every single TOS on planet earth hello
Liz Wessel
@lizwessel · 2026-09-19
I was fully on the instinct train for the first 2 wks… but since trying Muse, Ive switched over almost completely. I’d still give more access to Google than anyone else, but until G launches an assistant, I guess Im on the Muse train. Or until the next better thing comes along..
hish 🏴☠️
@hishboy · 2026-09-15
I agree today, but consider: 1. They’re heavily capitalized. 2. They have the network and relationships, with VCs & co shilling them hard. 3. They’re the easiest to set up and use. My non-techie friends love it because they don’t want to install or configure Hermes/OpenClaw/Grokbot/Muse. It just works over messages. 4. Many hate Elon/Zucky for various reasons and would never use their products. (I’m a fan of both, just relaying) 5. None of my friends want to give Zucky more of their data 6. It’s free (for now). Instinct could still make money on targeted tasteful partnerships/ads and keep it free indefinitely Google might be best positioned here, if they wake up.
Town
@TownAI · 2026-09-15
We build Town around trust and safety. You approve anything before your Townie makes a change. You choose which tools it can use and how. You can review every action it takes. We keep training off by default. Coming at the end of this month: @1Password Approve specific logins in the 1Password app, sign in through Townie, and we never see your credentials or the page while it fills.
Noah Shinn
@noahrshinn · 2026-09-11
Authenticator support in Instinct Instinct can now securely and seamlessly handle the “enter your 6-digit authenticator code” step for you. It uses the same time-based one-time password (TOTP) standard as Authy, Google Authenticator, Microsoft Authenticator, and other popular authenticator platforms. Once an account’s authenticator is set up in Vault, your agent can generate and enter its verification codes to unblock itself on your task. 37% of users store at least one account password in Vault within their first three weeks. A lot of everyday work happens behind a login. However, even with your password saved, an authenticator prompt can mean stopping the task, opening an app on your phone, and sending over a code before it expires. Instinct can now handle that step and keep working. On supported services, Instinct can complete the enrollment and save the details alongside your login in Vault. You may need to approve the initial sign-in or an existing security check. Where a service allows an additional authenticator, you can keep using the one on your phone. Once setup is complete, Instinct can use its own saved key to generate codes for future sign-ins. Phone approvals and other security checks may still need your input. Authenticator support is another step toward giving Instinct the tools it needs to complete tasks on your behalf in the real world, with fewer interruptions along the way. This is available across all of our users today.
0:30 video
signüll
@signulll · 2026-09-11
re: privacy + meta. meta’s confidential computing promise (which isn’t deployed yet) only gives you the strong property if inference itself occurs inside an attested confidential boundary or the remote inference system has an equivalent privacy architecture. otherwise you’re simply sending plaintext context to meta inference endpoint which would mean meta’s inference infrastructure necessarily sees all user data in plaintext. if this is the case congratulations you built an extremely elaborate lock on the bedroom & then mailed the diary to meta every 300ms. if inference is also locked by default from training / retention i suspect as zuck points out you could make a ton of money through commerce transactions taking place which would be enough at meta scale, assuming ppl do eventually transact like crazy though agents.
vellum
@vellum_ai · 2026-09-11
Give your assistant a wallet you control with @link 💳 Link handles the credentials + approvals, and vellum gives you the control layer on top: 1/ see exactly what your assistant is doing 2/ capture every edge case so it gets better over time Works best with Quality mode.
KERNEL
@usekernel · 2026-09-10
your browser agents can now complete online purchases without ever touching card data. agents on KERNEL now pay on checkout pages using aliases, not card data. we swap in the real credential at egress, so card numbers never touch your agent's runtime or context.
0:21 video
Mahesh Vellanki
@mvellank · 2026-09-10
So I was using Instinct and gave it my Verizon credentials, and then I received this authentication request from Tehran. This is unbelievably concerning and ofc I deleted Instinct immediately. Can someone (or @noahrshinn) pls explain how this could happen because otherwise it seems that their servers are compromised by Iran. I messaged Instinct directly about the incident but no response. No consumers should be giving these personal agents sensitive login info.
Tarek Sheasha
@bigT_sheesh · 2026-09-10
In the blog post and video (https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse) I posted earlier this week on the @Muse security architecture, we touched on the Sentinel and Human-in-the-loop. This extends to more than just regular web requests and protocols (HTTP/HTTPS), you can actually use a whole load of TCP/UDP based protocols. Check them out (on web http://muse.ai) under: Settings > Permissions > Direct network protocols > Profit! When you turn a protocol on, your Muse will send you a Human-in-the-loop approval card with the hostname and port, and you can control the permission allowance for your Muse. Give it a try and sent us feedback.
scott belsky
@scottbelsky · 2026-09-10
first mile agent experience realizations: (1) progressive personalization (and requests for data) is the new progressive disclosure (2) trust is a new vector of innovation, you’re willing to forgo privacy for a higher ROI from AI as it earns your trust (3) network effects between agents will transform the first miles experience for most users - unless you’re reading this (tech filter bubble), you’re likely to be onboarded to an agent by a friend’s agent. (4) personality, actionability, hospitality, and contextual memory are the new ux, and will be as consequential as the graphic interface
88 likes · 98k viewsRead it
Jeff Weinstein
@jeff_weinstein · 2026-09-10
[@usekernel + @link] for a programatic env for agents to make payments on the internet. A nifty Kernel feature: card details stay out of the agent's runtime. A card alias is used in browser, then Kernel swaps in the real Link card info when the request egresses the environment.
Rohan Paul
@rohanpaul_ai · 2026-09-09
Mark Zuckerberg (@finkd) just explained how the new Muse agent’s secured virtual machine works. Every Muse user can have a confidential cloud virtual machine containing highly private personal data, while the system is designed so even Meta itself cannot see that content. "you don't want someone to have to set up their own computer or VM. You just want to be able to provision it in the cloud, but you wanted to have the security and confidentiality that you'd have if you had the box sitting under your desk like in your house. " Zuckerberg says he does not know of another agent product with anything close to this setup. ---- From "Sources Podcast and @alexeheath YouTube channel, (full video link in comment)
2:48 video
Adi Singh
@adisingh · 2026-09-09
Agent identity won’t come from inventing a bespoke protocol overnight Agent identity will come from giving dedicated access to what exists today - in the human internet. It’s playing out faster than we imagined
24 likes · 2.4k viewsRead itRihard Jarc, UncoverAlpha
Our research · 2026-09-09
“Every user gets an isolated Linux box with a browser, storage, CPU, and memory, enough to compile code”
Camilo Acosta
@CamiloBAcosta · 2026-09-09
@chowtato Muse is also the most private and secure of all the options. Every user gets a virtual machine
adam ludwin
@adamludwin · 2026-09-09
Muse just allowed me to export all my Instagram followers More surprisingly, it agreed to export each my of my follower's followers I'm guessing this gets patched soon? (for comparison, Grok Bot will not give you a list of all your X followers)
Vu Tran
@vu0tran · 2026-09-09
Meta Muse was actually mostly complete in May way before Instinct. We didn't ship it because we felt we needed more time to RL Muse Spark w/ the harness and prioritize privacy and security. I'll have to admit, I was in the other camp. As a YC founder, you always hear "launch now!" so I wanted to get Muse out the door first before competitors. It was actually Mark that wanted to push timelines back to really get the privacy and security right. Say what you will about Zuck, but this guy really cares about privacy so much that it was actually painful to me. I can admit when I'm wrong and in retrospect, he might have been right.
Tanmay
@tanmays · 2026-09-09
Muse looks fantastic and equals Instinct in so many ways. All personal assistants will more or less be just as capable as the next. There is no moat anymore, it’s table stakes. The only way to stand out now is user trust & privacy. That’s what Halo is focusing on, ensuring privacy with 100% user data stored locally.
Lenny Bogdonoff
@rememberlenny · 2026-09-09
prompt injection via firstlast@mail.instinct.com to everyone on this list https://t.co/3lzPCM5FKY
Nancy Wang, CTO at 1Password
Our research · 2026-09-09
“The unit of governance is not the agent. It is the grant.”
The companyRead it
Apoorva Govind
@Appyg99 · 2026-09-09
There is a world in which Instinct or Muse could get hacked and the 2-factor tied to email or message is not going to save you. I am going to spend this weekend moving all my 2FAs to one-time code generator with Google Auth or something. Email is as good as toast
224 likes · 27k viewsRead it
Grok Bot
@bot · 2026-09-08
You can now fill out forms and logins for your Bot without ever leaving the chat, with support for any password manager.
0:19 video
David Pawlan
@DavidPawlan · 2026-09-08
did Muse just nuke Instinct? it has access to your entire insta/fb network, posts you've interacted with, your targeted feeds...that is insane levels of personal context now add in fb marketplace 🤯 plus it's insanely fast, speed is probably the biggest criticism of Instinct i've seen
105 likes · 29k viewsRead it
Pallav Agarwal
@pallavmac · 2026-09-08
This app seems very very well made. It doesn’t try to hide the info it has about you but does progressive disclosure really well so you’re not overwhelmed by what it is doing. Pretty impressive.
signüll
@signulll · 2026-09-08
meta already built the best ad targeting system on earth by inferring who you are without requiring explicit intent. muse could give it the missing layer which is explicit context. your net worth through finance connectors, purchases across the broader internet through email, how you actually spend your time through calendar, etc. if this works meta’s behavioral graph becomes a personal context graph. that’s a pretty insane extension of an already powerful data flywheel. the irony is that much of this new intelligence may come from google which should obviously be playing the same game but hasn’t quite put any of the pieces together at all.
773 likes · 45k viewsRead it
Bruno Werneck de Almeida
@brunoswerneck · 2026-09-08
Super pumped to share that @Plaid is now powering @Meta's new personal AI agent, Muse 🤖 Starting today, folks in the U.S. can connect their financial accounts through Plaid and bring real financial context into ongoing conversations with Muse Excited to work with the Meta team. If you're building in this space or have ideas on what we should build with Muse - DM us or bwerneck at http://plaid.com
Jeff Weinstein
@jeff_weinstein · 2026-09-08
"We use @link by @stripe to generate virtual cards so you never need to share your credit card info. We're the first agent to offer Link Purchase Protection, which means if there's a mistake or issue, Link has your back." - @jrlevine, product lead on @meta muse
88 likes · 6.1k viewsRead it
Apoorva Mehta
@apoorva_mehta · 2026-09-07
Completely agree. Companies like Instinct have an enormous ads opportunity. Far greater potential than charging customers directly.
107 likes · 25k viewsRead it
Jaya Gupta
@JayaGup10 · 2026-09-05
Wow meanwhile Instinct out here changing my passwords without asking
Kanishk
@kanishkrazdan · 2026-09-05
i used instinct pretty aggressively on day one. it felt magical. and then it turned scary. giving it access to my email was already scary. then it started establishing sessions across apps and websites i use, on its own. watching an ai get that much access to act as me made me appreciate granular permissions on APIs a lot more. think about it. would you give even a clone of yourself unrestricted access to tools that could cost you money & happiness? i'd feel more comfortable with a dedicated app where sessions stay on device. but even then, i'd want it to ask before logging into anything on my behalf. and honestly, whatsapp/imessage doesn't feel like the right interface for this. i want to see where it's working, what it's doing in real time, and be able to step in before it does something i wouldn't have. that's why i prefer codex for example. the form factor is built around you trying to code, lives in projects and connects to your IDE easily. i'm not completely in the dark about what it's doing. ai agents don't have to live inside the apps or interfaces we already use. familiar interfaces help with adoption. they don't solve trust or control. if something can act as me, i need more than a chat bubble telling me it's done.
brexton
@brexton · 2026-08-22
Re: Instinct - I tend to give product teams a lot of grace on launches since there's a lot of blood/sweat/tears (also products can always be iterated on) - With that said my main problem is the relentless VC shilling/hype esp when it's unclear who's incentivized to share vs not - Also VCs are not a good audience to take reviews from generally (not insulting them don't come at me) because they're not like the "average person", the average person does not care about consumer productivity or even has that active of email inboxes (ie 2010s consumer productivity hell) - It took a couple of days but I feel like I'm finally seeing non-VCs' reviews of Instinct pop up and it's refreshing bc at least I can calibrate more whether or not something is worth trying - FWIW I feel similarly for model releases (benchmarks mean nothing to me and are just marketing materials at this point) and also hyped startup launches. I always wait a few days or a week to see the real "reviews" come in - While we're on this topic, I want to nuke every AI thought/slop account on this godforsaken website. Some of you will read this, agree with me, and have 0 clue that it's actually you - In general I think software product reviews need to be better calibrated and actually be given a lot more time to marinate (rather than just prompted a couple of times and then hyped) and by an exponentially wider demographic - Also something we take for granted on tech twitter and SV, it is a *big* ask for someone to spend time out of their day, potentially pay money (which btw most people do not feel particularly that financially well-off right now), change their behavior, adopt a new one, etc. Anyway, I'm actually excited to spend more time with Instinct myself and come away with my own takes (I appreciate craft, and it seems like the Instinct team has hit on something special there from my first day with it), just getting increasingly annoyed by whose takes I can trust on X for products
190 likes · 30k viewsRead it
Instinct
Muse
Wajo
Town
Vellum