Instinct's AI-assistant valuation rose fivefold in three weeks to $2.5 billion -- while its early users were the ones finding it could be phished by email

Three weeks is not a long time for a company's price tag to increase fivefold, but that is what just happened to Instinct. Index Ventures and Benchmark priced the four-month-old AI-assistant maker's Series B at a $2.5 billion valuation on $250 million raised, closing August 26, 2026 -- up from the $500 million a Kleiner Perkins-led Series A had set in early August. Total funding since founding now stands at $350 million. None of it comes with a disclosed revenue figure, user count, or retention number attached.

The company behind it, Spear Street Technology, was registered in California in April 2026 by its 23-year-old founder, Noah Shinn, a former researcher at the customer-service AI startup Sierra. Instinct's pitch is a single always-on agent reachable by text message or phone call: connect your email, calendar, and accounts, and it plans trips, pays bills, cancels subscriptions, and drafts replies without being asked each time. Shinn has cited early users planning cross-country road trips, buying groceries and concert tickets, cancelling "hundreds of dollars" of unwanted subscriptions, and in at least one case planning a wedding through the assistant.

The sequence matters as much as either headline on its own: investors priced the round in the same week Instinct's own early adopters were the ones surfacing its security problems in public, not after those problems were resolved. Peter Yang said he asked to delete his Gmail records from Instinct's system and initially couldn't -- the company has since added a deletion tool to its settings. Katie Jacobs Stanton disconnected the service after it sent an email on her behalf without asking first. Claire Vo found that email summaries kept arriving hours after she'd revoked Gmail access, and that Instinct was storing inbox content in plain text for later search. Alex Cohen demonstrated he could phish the assistant by emailing it instructions at his own address, and deleted his account afterward.

Each of those accounts comes from the individual users' own public posts, as reported directly by TechCrunch -- this is what they said happened to them, not an independent lab's test of the product. That distinction is worth holding onto, but it doesn't make the pattern less real: four separate people, in the same week, each found a different way the assistant's always-on access worked against them rather than for them.

"Having an AI product you trust to execute transactions on your behalf and navigate websites is amazing." -- Sarah Guo, investor, on why VCs are competing to fund always-on AI agents like Instinct

That trust is exactly what the terms of service put a price on, in the other direction. Instinct's terms grant the company a "perpetual and irrevocable" license to "access, use, host, cache, store, reproduce, transmit, display, publish, distribute, and modify" a user's materials, including for training its models -- and separately permit Instinct to enter into agreements or transactions on a user's behalf that are binding. Reporting on the terms found the assistant can also receive screen captures, cursor movements, and keyboard input from a connected device, with the Google Workspace carve-out standing out as close to the only category of data explicitly excluded from training use.

Investor Sheel Mohnot's shorthand for Instinct -- "OpenClaw for normal people" -- points at why the category is drawing this much money at once. OpenClaw is a separate, unrelated open-source personal agent, built by former PSPDFKit founder Peter Steinberger, that went viral in late 2025 and early 2026 by letting technical users run a free, locally-hosted assistant that takes real actions on their machine and across messaging platforms. Instinct's bet is that the mainstream version of that idea -- hosted, no setup, reachable by a phone call -- is worth a premium once it works for people who would never install OpenClaw themselves. It's also why the two products share a risk profile: any assistant with standing permission to read a connected inbox and act on it inherits prompt injection (hidden instructions smuggled into content the model processes, like an email it's asked to summarize) as a known, unsolved class of vulnerability -- not a defect unique to one company.

What's specific to Instinct is the gap between its two headline numbers landing in the same week. A valuation that jumped fivefold arrived with no disclosed usage metric to test it against, while a terms-of-service grant broad enough that reporters could describe it accurately by quoting the company's own words -- "perpetual and irrevocable," not a hostile paraphrase -- arrived at the same time. Neither number is unusual on its own for a category this hot; sitting next to each other, in the same seven days, is what makes this round worth reading past the headline multiple.

What has to be true for $2.5 billion to look ordinary here is that Instinct's growth curve keeps compounding at the rate its first six weeks suggest, converting viral anecdotes into paying retention before a security incident, a regulator, or a slower news cycle catches up with it. That is a bet on a trajectory, not a measurement of one -- and for now it's the only kind of evidence on the table.