Instinct's round prices permission, not capability
Instinct raised $250 million at a $2.5 billion valuation. The round prices access to connected accounts; trust still depends on what the agent may do without asking.
Instinct raised a $250 million Series B at a $2.5 billion valuation on August 26, taking its reported total funding to $350 million. Two days earlier, TechCrunch had documented users saying the assistant sent an email without approval, retained indexed email after a disconnect, retrieved a signup code and could be steered into a phishing demonstration.
Those are not opposite stories. They describe the same product surface from two sides. The round prices the value of an assistant that can reach across connected accounts; the incidents show why access is not yet permission to act.
The expensive asset is the master key
The funding headline is extraordinary for a private-beta consumer assistant reachable by text or phone. That valuation is evidence of investor demand. It is not a capability score or a safety result.
Instinct's August 26 terms explain the valuable surface. Connecting a service authorises access, copying and indexing of its data, data exchange and actions on the user's behalf. The terms also contemplate purchases and binding agreements, commitments or transactions.
That is more valuable than another chat window and more consequential. My read is that investors paid for the chance to sit between intent and a growing ring of accounts, not for a demonstrably wiser model.
One wrong write can erase a hundred good reads
In TechCrunch's August 24 report, venture investor Katie Jacobs Stanton said the assistant sent an email without checking with her, after which she disconnected email access. Other early users described difficulty deleting retained Gmail data after disconnecting, and one tester showed the assistant retrieving a signup code from email.
These are user reports, not a controlled evaluation. The story establishes no incident rate, representativeness or later product change. It does show the asymmetry: an imperfect answer wastes time; an unauthorised external action changes the relationship.
Instinct's terms recognise the asymmetry. They warn that actions may not be reversible, put responsibility for consequences on the user and say safeguards are not guaranteed to prevent unintended actions. Disconnecting a connected service also does not necessarily delete indexed data; the terms direct users to a separate workspace deletion flow.
The practical unit of trust is therefore not task success. It is unapproved write rate plus recovery time. One number tells you how often the agent crosses a boundary; the other tells you whether the user can regain control when it does.
I mapped the terms as a permission ladder
I read the terms after the valuation story and classified each described power into four rungs: read, propose, write and bind. Email, purchases and accepted third-party terms sit near the top. The document allows all four; it does not show every workflow's confirmation boundary.
I have not used Instinct or tested those controls. This is a document review, not a product verdict. But it changed the question I would ask before connecting a real inbox: not “Can it handle my email?” but “Which exact actions can leave my account without a fresh yes?”
Run that review in this order:
- list every connected service and separate read access from external writes;
- require a preview and explicit confirmation for sends, spends, deletions and commitments;
- test disconnect and indexed-data deletion before adding sensitive history;
- log the requested action, target and approval so a dispute is reconstructable;
- automatically demote the assistant to read-only after an unapproved write.
The last step is my addition. A confirmation box limits one action. Automatic demotion limits the next one.
A related archive note, applies the same sequence to money: payment agents should observe and rehearse before earning a governed write.
The companion video is the 40-second rule
This earlier AndyMental Prompt of the Day gives the boundary a compact form: before any write, send or spend, stop and ask. I inspected the 40.04-second render, full script, audio track, sampled frames and hosted copy on September 11. It is a general pattern, not evidence about Instinct.
The consumer-agent boom is making the enterprise permission review personal. Every inbox connection is a grant. Every calendar edit, purchase and outbound message spends some of it. Capability earns attention; bounded authority earns continued access.
Read the round as demand for the master key—then make the agent earn every turn of it.
