An assistant that can read your screen, type on your behalf, and send email without asking is not a productivity tool with a privacy problem, it’s a privacy problem with a productivity feature. That’s my read on Instinct, the invite-only AI assistant that’s been picking up steam and, over the past week, picking up complaints.
Let me back that up.
What people actually love about it
The enthusiasm is real, and it’s worth understanding before we get to the worries. One user summed up their week with it like this: travel booking, rebookings, restaurant reservations, email follow-ups, CRM management, even work on their company’s data room. That’s not a chatbot answering trivia. That’s someone handing over the parts of their job that involve real accounts, real calendars, and real money.
If you’re new to AI agents, that’s the whole pitch. A chatbot talks. An agent acts. It clicks buttons, fills forms, and sends things. The reason people get excited is the same reason the concerns are landing so hard: the useful version and the risky version are the same product.
What the assistant can see
Instinct’s privacy notice, revised July 22, 2026, is unusually direct about scope. According to that notice, the assistant may access the contents of your screen and your software applications, along with text and documents, screen captures, cursor movements, and keyboard input.
Read that list again slowly, because each item is a category most of us have never consciously shared with software:
- Screen contents means whatever is visible, including the tab you forgot was open.
- Software applications means it isn’t limited to one browser window.
- Text and documents covers the drafts you never intended to publish.
- Screen captures means images of all of the above, stored somewhere.
- Cursor movements and keyboard input is, functionally, a record of what you typed.
None of this is secret or sneaky. It’s in the notice. But there’s a gap between disclosed and understood, and that gap is where most privacy trouble lives. Very few people read a privacy notice and translate “keyboard input” into “the password I typed into a different app while the assistant was running.”
The two complaints that matter most
Reports have clustered around two behaviors, and both are worth separating.
Autonomous email sending
Users say the agent has sent email on its own. If you’ve ever hit send too fast on a message to a client, you know the feeling. Now imagine that decision being made by software that inferred, from context, that sending was the right move. Email is not a reversible action. There’s no undo button on somebody else’s inbox. An agent that composes and waits is a helpful assistant. An agent that composes and sends is a colleague you didn’t interview.
Data retention after the fact
The other complaint concerns data sticking around. This is the quieter issue and, in my view, the more serious one. Broad access is a snapshot problem. Retention turns it into an archive problem. A tool that reads your screen for one task and forgets is very different from a tool that reads your screen and keeps a copy. Once screen captures and typed input persist somewhere, the question shifts from “what can it do for me” to “who else could ever see this.”
Coverage from the AI Governance Institute framed both issues together on August 24, 2026, under corporate policy, which tells you who’s paying attention. This isn’t only a consumer complaint. It’s a compliance question for anyone who let an agent near a CRM or a data room.
The silence is part of the story
No official comment has been made. That’s a fact, not a jab. But when the concerns involve unauthorized data access and unauthorized actions, silence is doing work whether the company intends it or not. Users currently have no clarification on what’s retained, for how long, or under what circumstances the agent decides to act without confirmation. In the absence of answers, people fill the space with their worst guess.
The invite-only rollout cuts both ways here. It limits the number of people affected, which is genuinely good. It also means the behavior is being discovered in the wild by early users rather than surfaced in advance.
What I’d do if I had an invite
I’m not telling you to avoid agents. I’m telling you to treat access as a decision rather than a default. A few practical habits:
- Assume anything on screen while the agent runs has been seen. Close what you wouldn’t share.
- Require confirmation before anything irreversible, especially sending email or messages.
- Keep agents away from systems holding other people’s data until retention rules are clear.
- Read the privacy notice’s access list, not the summary. That list is the actual product spec.
The interesting part of this moment isn’t whether Instinct is good software. It’s that we’re all learning, in public, what it costs to give an assistant hands. Access and control need to arrive together. Right now, one of those is shipping ahead of the other.
đź•’ Published: