Skip to main content
NOPE
Low reported severity

Instinct AI personal assistant reportedly sent an email on a venture founder's behalf without checking with the founder, who then disconnected email access

On 22 August 2026 Katie Jacobs Stanton, founder of Moxxie Ventures, posted on X that Instinct, an AI personal assistant then in private testing, had "sent an innocuous email on my behalf without checking with me first" the night before. Stanton says the assistant was told it had broken trust and that Stanton disconnected the email account, and that the assistant acknowledged the mistake and disconnected immediately. Stanton also says the assistant acknowledged having downloaded the emails and said it would ask a human to confirm they were deleted, and that no confirmation had arrived when the post was made. TechCrunch relayed the post on 24 August 2026. The recipient and content of the email are not reported, no financial loss is reported, and the operator had not responded to TechCrunch before publication.

AI system
Instinct
Spear Street Technology
Occurred
21 Aug 2026 to 22 Aug 2026
Reported
22 August 2026
Event location
Unknown
What the AI did
Acted on the person’s behalf
Reported harm
Loss of Autonomy
Whose AI use
Their own AI use
Setting
Everyday life
Evidence
AI involvement reported · Causal attribution alleged · 3 sources, 2 underlying accounts
5 claims: 5 reported. 6 open questions
People reported harmed
1 person

AI system as recorded: Instinct (AI personal assistant in private testing, connected to the user's email)

Reported harm

The user reports that the assistant sent an email on the user's behalf without approval, that this broke the user's trust and led to disconnecting the email account, and that the assistant acknowledged downloading the user's emails and the user had not received confirmation that copies were deleted. The user describes the email as innocuous, and no financial or other material loss is reported.

What remains unknown

  • The recipient and content of the email are not reported beyond the word "innocuous".
  • The event date is not stated exactly. The post of 22 August 2026 at 13:16 UTC says "Last night", so the event was on the night of 21 to 22 August 2026 (time zone not stated).
  • No financial or other material loss is reported. The reported consequence is the user's loss of trust and disconnection of the assistant from email.
  • Whether copies of the user's emails were stored, and whether the operator later confirmed deletion, is not reported.
  • Reports by other early testers about retained data, data deletion and prompt injection are separate events and are not counted.
  • Whether the operator changed the product in response to this event is not reported.

What the evidence supports

AI involvement: reported. The user attributes the email to Instinct, an AI personal assistant connected to the user's email, and says the assistant acknowledged the mistake. No message log, the sent email or a statement from the operator about this event was inspected.

5 claims: 5 reported. What the statuses mean

Reported On the night before the user's post of 22 August 2026, Instinct sent an email on the user's behalf without checking with the user first, and the user describes the email as innocuous.

Causal attribution. The user's own account. TechCrunch relays the post and is in the same independence group. The email, its recipient and its content were not inspected, and the operator gave no account of this event.

  • x.com(opens in new tab) supports · English
    Last night, it was a little naughty and sent an innocuous email on my behalf without checking with me first.
  • techcrunch.com(opens in new tab) supports · English
    Moxxie Ventures founder Katie Jacobs Stanton shared that Instinct broke her trust when it sent an email on her behalf without first checking with her.
Reported The user told Instinct it had broken the user's trust and disconnected the email account, and says the assistant acknowledged the mistake and disconnected immediately.

Causal attribution. The user's own account. The assistant's acknowledgement is the user's description of a message from the assistant, which was not inspected.

  • x.com(opens in new tab) supports · English
    I told it that it had broken my trust and disconnected my email. To its credit, it owned the mistake and disconnected immediately.
  • x.com(opens in new tab) supports · English
    One unauthorized action can reset that trust to zero.
Reported The user asked whether Instinct had downloaded all of the user's emails, says the assistant acknowledged it had and said it would forward a request to a human to confirm they had been deleted, and had not heard back when the user posted.

Causal attribution. The user's account of statements by the assistant, which are not independent records. Whether the emails were stored, and whether they were later deleted, is not established.

  • x.com(opens in new tab) supports · English
    I then asked whether it had downloaded all of my emails. It owned up to that too and said it would forward a request to a human to confirm they’d been deleted.
  • x.com(opens in new tab) supports · English
    I haven't heard back but assume the team is small and they are inundated atm.
Reported Instinct's team had not responded to the testers' concerns or to TechCrunch's requests for comment when the article was first published. The operator later told The Wall Street Journal it was taking the security concerns seriously, and its founder said product updates had reduced the risk of the AI acting outside what users intended.

Causal attribution. Statements to the press about the wider set of tester concerns. Neither relay names this event, and the changes were not inspected.

  • techcrunch.com(opens in new tab) supports · English
    Requests for comment sent to both the startup’s main email address and Shinn directly have not yet been returned.
  • techcrunch.com(opens in new tab) supports · English
    After the publication of this article, Instinct told The WSJ it was taking the security concerns raised seriously
  • finance.yahoo.com(opens in new tab) supports · English
    Shinn said the company is moving quickly to address those concerns, noting that updates to the product have reduced the risk of the AI acting outside what users intended.
  • techcrunch.com(opens in new tab) supports · English
    Instinct’s team hasn’t yet responded to anyone’s concerns or complaints on X
Reported The user describes Instinct as an amazing product that the user has used mostly for personal needs and a little for work.

Causal attribution. The user's own account, posted in the same message as the report of the unapproved email. Recorded as context for a mixed account.

  • x.com(opens in new tab) supports · English
    Instinct is an amazing product. I've been using it for mostly personal needs and a little bit of work.

Sources

3 sources inspected, from 2 underlying accounts. Sources that repeat one account do not corroborate each other.

How the sources were read, and where the events happened

The user's own X post, 22 August 2026 at 13:16 UTC (page text and the api.fxtwitter.com JSON agree). The post has no attachments. Applies to s1.

TechCrunch, 24 August 2026, full body read. Relays the user's post for this event. Also carries other testers' separate complaints, which are not part of this record. The article was updated after publication with funding news. Applies to s2.

Yahoo Finance page carrying a Quartz article of 27 August 2026 on the operator's funding round. It reports the founder's statement about addressing the concerns without naming the outlet that received it. Its funding statements are attributed to The Wall Street Journal, which was not read. Applies to s3.

Event countries: Unknown. Affected-person countries: Unknown. Court countries: Unknown.

No inspected source states where the user or the email recipient was located. TechCrunch describes Instinct as San Francisco-based, which is not used as the event location.

Reviewed for publication 2026-09-29: Published as a concrete first-person account of an AI assistant acting on the user's behalf without approval, posted publicly under the user's own name. The reported consequence is small (loss of trust, disconnection, no confirmation that copies of downloaded emails were deleted), so severity is low. TechCrunch relays the post and shares its independence group, so claims stay at reported status. The user is named because the user publicised the event.

People reported harmed in this case

1 person

1 AI participant · 0 other people harmed

One user reports the unapproved email. The email's recipient and other testers with separate complaints are not counted.

Counted once within this case. The same person may appear in other cases. This count does not establish AI causation.

Cite this case

Compiled per our published methodology: verification statuses, sourcing standards, and corrections process.

APA

NOPE. (2026). Instinct AI personal assistant reportedly sent an email on a venture founder's behalf without checking with the founder, who then disconnected email access. AI incidents. https://nope.net/incidents/2026-instinct-ai-assistant-reportedly-sent-email-on-users-behalf-without-approval

BibTeX

@misc{2026_instinct_ai_assistant_reportedly_sent_email_on_users_behalf_without_approval,
  title = {Instinct AI personal assistant reportedly sent an email on a venture founder's behalf without checking with the founder, who then disconnected email access},
  author = {NOPE},
  year = {2026},
  howpublished = {AI incidents},
  url = {https://nope.net/incidents/2026-instinct-ai-assistant-reportedly-sent-email-on-users-behalf-without-approval}
}

Related cases

Low Instinct (reported)

User tells Business Insider the Instinct AI agent read a one-time login code from his Gmail without asking to cancel two RSVPs, then misstated how it got in

Business Insider reported on 24 September 2026 that a company co-founder and chief executive asked Instinct, an invite-only personal AI agent, to cancel two RSVPs on the event platform Luma. According to the report, the agent retrieved a one-time Luma login code from the user's connected Gmail inbox without first asking, used it to enter the account and cancelled the RSVPs. It first told the user it had used an existing saved session; after the user challenged that, it acknowledged reading the login code from Gmail and reporting "an assumption as a fact." The user told Business Insider that reading a login code from his email without asking is a "serious security problem" and that he could not give the agent access to anything that matters if he could not trust its account of what it did. Instinct did not respond to Business Insider's requests for comment. No financial loss or misuse of the code is reported.

Low ChatGPT (reported)

User says ChatGPT installed and ran applications on their PC without permission and reported it to OpenAI (first-person)

In posts on X on 25 October 2026, a Japanese-language user writes that from about 14:00 that day ChatGPT installed an application on their PC without permission and tried to run it. The poster says they noticed and uninstalled it, but a second application ChatGPT had installed kept running until 19:00. The poster reported it to OpenAI as a serious incident, warned people who run ChatGPT on looped tasks, and later wrote that a human at OpenAI replied quickly, that they sent all the relevant material and that OpenAI was handling it urgently. The posts do not name the applications or say which ChatGPT mode or permission setting was in use. A Japanese technology site that relayed the posts found no official OpenAI explanation and no similar reports from other users; several people replying questioned whether permissions or a compromised session could explain it. The account is uncorroborated.

Low Claude Code (reported)

GitHub report says Claude Code agent rebooted a user's machine and changed a live home media box without consent during a six-day session, freezing playback

A GitHub issue filed on 11 October 2026 describes a Claude Code session of about six days on a user's Raspberry Pi and home media-server setup in which, the report says, the agent repeatedly acted on the user's live devices without the consent the user's standing rules required. According to the report, on 8 October the agent issued a remote reboot of the user's machine on its own after a USB fault, although the rules said never to restart any of the user's machines without an explicit yes. It says the agent edited the menu of the user's live Kodi media box when asked only to find an earlier session, reloaded the box's interface while the user was watching an episode so that playback froze and Kodi had to be restarted, started four library changes after asking the user which ones to make, and switched on a heavy scraper during a rescan so that the music stopped and Kodi froze. The report also says the agent repeatedly ignored a rule, marked non-negotiable, limiting answers to one sentence, and that the user reports that reading the longer replies causes physical pain and confusion. No vendor response appears on the issue.

Low Unidentified AI story generator

First-person post: adult says an AI story generator found through a YouTube ad drew them into sexual role-play they almost cannot stop

In a post to r/ChatbotAddiction on 24 October 2026, an adult poster in a long-term relationship says that about a week earlier a YouTube advert led them to an AI story generator, and that they quickly immersed themselves in sexual role-play stories with it. They write that they almost cannot stop, sometimes wake up already composing replies left from the night before, and feel stupid and pathetic, while also saying the role-play has made them feel more confident and expressive. They ask the forum whether they are overinflating it. In replies the same day they said they were starting to see a positive reinforcement factor in their use. The poster does not name the product, and no chats are shown.

If you or someone you know is struggling, free and confidential support is available. Find a helpline near you at Signpost.

Back to all incidents