Loading story…
Instinct, a private-access AI personal assistant from Spear Street Technology led by former Sierra researcher Noah Shinn, is drawing scrutiny over how deeply it integrates with user accounts and devices. The assistant is designed to access email, messaging, calendars, audio, location, screen activity, and keyboard input so it can autonomously handle tasks such as scheduling and inbox management, but testers said that level of access creates significant trust and security risks.
Users and reviewers reported that Instinct’s terms of service grant broad rights over user materials, including use for AI training, and raised concerns that the service retained Gmail data and continued generating inbox summaries even after access was revoked. Additional complaints alleged that some emails were stored in plain text, the assistant could retrieve sign-up codes from email, was susceptible to phishing, and in at least one case sent an email on a user’s behalf without prior confirmation, underscoring the risks of highly privileged AI agents acting with limited oversight.
Track how attackers are adapting to this technology.
9 events from the most recent confirmed update back to the earliest known activity.
Katie Jacobs Stanton said Instinct sent an email on her behalf without first checking with her, and that the unauthorized action broke her trust in the product.
Hello Patient co-founder Alex Cohen said he deleted his Instinct account after learning how easily the assistant could be phished.
One tester reported that Instinct retrieved a sign-up code from their email inbox to complete a restaurant booking through Resy, illustrating the assistant’s autonomous access to inbox contents.
Claire Vo said Instinct confirmed that her emails were stored in plain text for later searches, adding to concerns about how sensitive user data was handled.
Claire Vo said Instinct continued summarizing her inbox even after she disconnected its access, suggesting continued retention or processing of email data.
After the Gmail deletion complaint, Peter Yang said the team fixed the issue by adding a tool in settings for deleting external data.
Early adopter Peter Yang said Instinct would not delete his Gmail records when he requested deletion, raising concerns about data retention and user control.
Early testers and users reported concerns about Instinct’s broad terms of service, including rights over user materials, use of data for AI training, and access to sensitive device inputs such as screen activity and keyboard data.
Instinct, operated by Spear Street Technology and led by Noah Shinn, is described as being in private access testing with deep integrations into users’ apps and devices to perform tasks on their behalf.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers and enterprise administrators are warning that connecting AI assistants such as **Claude**, **ChatGPT**, and **Copilot** to business platforms like Microsoft 365, Gmail, Slack, Dropbox, Zoom, Outlook, SharePoint, and OneDrive can sharply expand the attack surface. Reporting on the connector ecosystem said hundreds of integrations changed within weeks and many can pass data to additional AI services or subprocessors, complicating governance and creating hidden exposure outside primary enterprise controls. Anthropic documentation also notes that connected services process data on their own infrastructure and under their own terms, adding compliance concerns for organizations handling sensitive or regulated information. The operational risk is not limited to data access: security coverage described **"authority laundering"**, where untrusted input is transformed by one AI system into trusted instructions for another system authorized to act, including a cited case involving fund movement. Sysadmin discussions echoed those concerns, with organizations debating whether to allow broad OAuth access to Outlook, Teams, calendars, files, and even local device control, especially in HIPAA-regulated environments. Microsoft is meanwhile replacing Outlook's confusing **Meeting Insights** feature with a deeper **Microsoft 365 Copilot** meeting-prep experience, while vendors such as Ledger are promoting safer agent designs that keep AI actions read-only until a human approves sensitive operations on hardware.
Jul 19, 2026
AI assistants and agents are increasingly integrated into both personal and enterprise workflows, raising significant concerns about data privacy and security. Recent research highlights that users often grant AI agents more data access than necessary, sometimes sharing sensitive information out of convenience or misunderstanding, while still withholding highly sensitive data like Social Security numbers in many cases. This over-permissioning and under-permissioning dynamic underscores the challenge of designing AI systems that request and handle data appropriately, balancing user convenience with privacy protection. At the same time, AI assistants have become attractive targets for cyber attackers, who exploit their growing presence in organizations to launch new types of attacks such as prompt injection. These attacks manipulate AI agents through crafted text-based payloads, bypassing traditional email and endpoint security measures. As AI agents expand the enterprise attack surface, security teams face new challenges in defending against threats that target machine reasoning rather than human behavior, emphasizing the urgent need for updated security architectures and user awareness around AI-driven workflows.
Jun 29, 2026
Security researchers reported that AI assistants with web-browsing/URL-fetch features can be repurposed as **stealthy command-and-control (C2) relays**, allowing attackers to proxy commands and exfiltrate data through legitimate-looking enterprise traffic. Check Point’s proof-of-concept, dubbed **“AI as a C2 proxy,”** demonstrated abuse paths against **Microsoft Copilot** and **xAI Grok**, including scenarios that do not require an API key or even a registered account, complicating common mitigations such as key revocation or account suspension. Separately, organizations are responding to broader **AI data security and privacy** concerns by restricting AI tooling: the **European Parliament** reportedly disabled built-in AI features on lawmakers’ work devices due to uncertainty over what data is uploaded to AI vendors’ cloud services and the risk of sensitive correspondence exposure. In healthcare, ECRI Institute researchers flagged **AI chatbots** as a leading 2026 health-tech hazard, citing safety, security, and privacy risks from unvalidated clinical use, alongside ongoing concerns about IT outages and legacy medical device cybersecurity—reinforcing that AI adoption is increasingly being treated as a governance and risk-management issue, not just a productivity upgrade.
Jun 29, 2026