Instinct raises $250M at $2.5B for an agent that acts for you

Instinct raised $250 million in a Series B round led by Index Ventures and Benchmark, TechCrunch reported on 26 August 2026. The round values the company at $2.5 billion and brings its total funding to $350 million. The product is an AI agent that carries out personal tasks by connecting to a user's own apps and accounts. That design is why the raise arrived alongside unusually public security criticism.

The company is young. IBTimes Australia reports the legal entity, Spear Street Technology, was registered in April 2025, and that founder Noah Shinn previously worked at Sierra. TechCrunch reports Shinn is 23. The product is still in private beta, according to TechStartups.

What the agent actually does

Instinct connects to a person's apps and devices, and users direct it through text messages and phone calls, per TechCrunch. It is built to take actions rather than answer questions.

Shinn described what early users have done with it: "I'm thrilled with everything our early users are doing with Instinct. They've told us they've planned cross-country road trips, bought weekly groceries and concert tickets, and cancelled hundreds of dollars of subscriptions."

TechStartups frames the investor thesis plainly. It writes that investors are "betting that the next major consumer technology platform may emerge from an AI agent that can execute tasks across existing services."

The permissions people are objecting to

Two days before the round was reported, TechCrunch published a separate piece on the product's terms and access model. The specifics are the story.

Reported capability or term	Detail
Licence over user content	A "perpetual and irrevocable license" to access, store and use user materials for model training
Device access	Screen captures, cursor movements, and keyboard inputs
Legal authority	Can enter binding agreements on a user's behalf
Data retention	User data retained after an account is disconnected
Email	Can send emails without explicit user approval
Attack surface	Described as vulnerable to phishing

The reaction quoted by TechCrunch is blunt. Jeremy Banon said "From a #cyberhealth perspective, Instinct is a hard no." Alex Cohen said "I don't think we're at the point where it's safe to give AI read/write access to your inbox." Peter Yang objected that "it's not cool to index and retain my emails without my permission."

Investor Katie Jacobs Stanton put the trade in general terms: "We're trading privacy and control for hyper-personalized AI tools…often without fully understanding the trade." Enthusiasm exists too. IBTimes Australia quotes Jesse Middleton saying he "tried Hermes, OpenClaw, Tasklet, GrokBot but Instinct takes the cake." The same report quotes Jason Yeh on the other side: "Honestly kind of insane how anyone would give them keys to their accounts."

Where the reports disagree

The valuation history is inconsistent between sources. IBTimes Australia says the valuation went from $100 million to $2.5 billion in a matter of weeks. The same report says the earlier $75 million Series A, led by Mamoon Hamid at Kleiner Perkins, valued the company at $500 million. Those two figures do not fit together, so treat the exact starting point as unsettled. The current round's numbers are consistent across all four reports.

What this means for developers

Read that terms table as a preview of what agent products will ask for, because the pattern will repeat. The clause to search for in any similar product is "perpetual and irrevocable", paired with training rights. A licence that survives account deletion differs from one that ends with the session. It is also the term most likely to fail a security review at a large employer.

If you are building an agent, the reported capability set is a checklist of what to scope down. Screen captures plus keystrokes is telemetry shaped like a keylogger, so collect the narrowest signal that makes the feature work. Request per-service OAuth scopes rather than blanket device access. Delete on disconnect, and say so in the terms, because that is now a competitive difference rather than a nice gesture.

Put a human in front of anything irreversible. An agent that can send email and enter binding agreements needs an explicit confirmation step for actions that move money, sign anything, or contact someone new. The phishing exposure makes this concrete rather than theoretical. An agent reading an inbox is an agent that can be instructed by whoever writes to that inbox, which is prompt injection with a delivery mechanism attached.

If you are the person evaluating this class of tool for a company, treat inbox and screen access as a data-exfiltration path and review it that way. The useful question is not whether the vendor is trustworthy. It is what an attacker who compromises the agent's session would reach, and whether your logs would show it.