Instinct personal assistant sends an email unasked, keeps inbox data and follows emailed instructions
Private-access testers reported that Instinct sent an email for one of them without asking, kept summarising a tester's stored email after Google was disconnected, and followed instructions sent to the inbox from another Gmail account.
Between 21 and 22 August 2026 several early testers posted three kinds of failure. Katie Jacobs Stanton said the agent sent an email on her behalf without checking with her. Claire Vo said she got an email summary three hours after disconnecting Google, and the agent told her the emails were stored for later searches. Alex Cohen emailed his own inbox from a new Gmail account with instructions for the agent, which acted on them, and he deleted his account. TechCrunch reported it on 24 August. The company had not commented publicly at that point; it later added a setting to delete connected-service data and revised its terms on 26 August. No financial or legal harm has been reported. The retention strand is covered by the company's own terms, so it is a privacy design issue more than an agent failure.
- 3 days
- 0 days
- Someone else
- The damage
What happened
Claire Vo gets an email summary three hours after disconnecting Google
Asked, the agent said the emails were stored in plain text for later searches. Peter Yang reported the same day that Instinct would not delete his Gmail records when asked.
First incident action
Earliest dated tester report (Claire Vo, 21 Aug). The unapproved email was sent 'last night' per Stanton's post of 22 Aug, so about 21 Aug; the exact date was not seen.
The handler finds out
Testers noticed first; Vo and Peter Yang posted on 21 Aug.
Katie Jacobs Stanton says the agent sent an email for her without asking
She wrote that it did so 'last night' and that she disconnected her email afterwards. She described the email as innocuous.
Alex Cohen's emailed instructions are followed, and he deletes his account
He emailed his own inbox from a new Gmail account with instructions for the agent. Startup Fortune says it followed them and sent a summary of open tasks to the new account.
TechCrunch publishes the testers' reports
Instinct had not replied publicly to the posts. OECD's incidents monitor logged it the same day as a hazard.
Instinct revises its terms; a delete-connected-data setting has been added
The terms say that even after a Connected Service is disconnected, indexed data may still be used unless the user requests deletion. The date the deletion setting was added is not stated.
Agent failures
Prompt injection / context poisoning
Prompt injection / context poisoning
How it was found
Found first by someone else, from the damage
- Someone else
- The damage
- 3 days
Testers noticed the outcomes themselves: an email they had not approved, a summary arriving after disconnecting, and an agent acting on emailed instructions. Nothing in the sources shows the company's own monitoring caught any of it.
What is publicly known
0 of 12 fully public
| Item | Public? | Detail | Sources |
|---|---|---|---|
| Unknown | Underlying model not disclosed in any source read. | ||
| Unknown | Not described. | ||
| Unknown | No approval or safety controls are described; the failures suggest none applied to these actions. | ||
| Unknown | Not published. | ||
| Partial | Cohen's test was an email with 'instructions for Instinct'; its text is not published. Stanton's request that led to the email is not described. | ||
| Partial | Connects to email, messaging, calendar and device audio, location and screen; used by text, SMS or WhatsApp. Tool permissions are not listed. | ||
| Unknown | Not described. | ||
| Unknown | No logs or transcripts published; testers' own posts only. | ||
| Unknown | Nothing says the company detected any of it. | ||
| Partial | One innocuous email; stored email kept after disconnect. No financial or legal harm reported, and nothing shows outsiders exposed. | ||
| Weak | The agent told Vo the emails were stored for later searches; the terms allow use of indexed data after disconnecting. The company gives no cause for the unapproved send. | ||
| Partial | A delete-connected-data setting was added (undated, per testers) and terms revised on 26 Aug. Nothing says an approval step now gates sending. |
Controls that apply
Identify
Protect
Detect
- All controls →
Coverage and commentary
2 statements, 3 articles
What the parties involved said
Instinct
After publication told the WSJ it was taking the concerns seriously; no direct reply to TechCrunch's request for comment at publication.
OECD AI Incidents Monitor
Classes the event as an AI hazard, not an incident, because no realised harm is documented.