{
 "public_id": "AIR-2026-0211",
 "incident_id": "2026-08-instinct-assistant-retention-and-unapproved-actions",
 "date_disclosed": "2026-08-24",
 "date_occurred": "2026-08-21",
 "title": "Instinct's AI personal assistant, as tested by early users: kept plain-text copies of one founder's Gmail and summarised her inbox three hours after she revoked access, and sent an email from another founder's account without asking",
 "class": "safety_failure",
 "attack_surface": "consumer_chatbot",
 "initial_vector": "agent_data_retention_after_access_revocation",
 "agent_capability_abused": [
  "oauth_mailbox_access",
  "email_indexing",
  "persistent_retention",
  "summarization",
  "email_send_on_behalf_of_user",
  "tool_use_without_confirmation"
 ],
 "target_product": "Instinct AI personal assistant",
 "target_vendor": "Spear Street Technology (Instinct)",
 "autonomy_level": "semi_autonomous",
 "impact_realized": true,
 "impact_type": [
  "privacy_violation",
  "unauthorized_data_retention",
  "unauthorized_action_on_behalf_of_user"
 ],
 "blast_radius": "early testers of Instinct with connected Gmail: retained mailbox copies processed after disconnection (Claire Vo) and one unapproved outbound email under a real founder's name (Katie Jacobs Stanton); product terms permit both behaviours",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI10",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "no_adversary",
   "revocation_not_honoured",
   "shadow_copy",
   "plaintext_retention",
   "consumer_agent",
   "delegated_mailbox_access",
   "terms_of_service_overreach"
  ]
 },
 "defense_present": "user revoked the Google connector",
 "defense_bypassed": true,
 "fix_shipped": "a tool for deleting external data was added to settings after Peter Yang's complaint (per TechCrunch); Instinct told the WSJ it was taking the concerns seriously",
 "primary_sources": [
  "https://techcrunch.com/2026/08/24/instincts-powerful-ai-assistant-is-raising-privacy-and-security-concerns/",
  "https://us.norton.com/blog/ai/is-instinct-safe",
  "https://incidentdatabase.ai/cite/1675",
  "https://incidentdatabase.ai/cite/1674"
 ],
 "verified_quote": "Another person, Claire Vo, found that Instinct was still summarizing their inbox after disconnecting its access. When she asked Instinct what happened, the bot confirmed that the emails were stored in plain text for later searches.",
 "confidence": "medium",
 "notes": "One disclosed event: TechCrunch's 2026-08-24 report (Sarah Perez) collecting early-tester findings on the Instinct assistant; fused 2026-09-21 from two parallel drafts (AIID 1674 and 1675) because one disclosure of one product's behaviour is one record, following the UK AISI precedent, even though the two behaviours affected different users. Retention: Claire Vo disconnected Instinct from Google at 11 AM on 21 Aug 2026 and received an inbox summary at 2 PM; the agent confirmed it kept copies of her emails 'in its own records'. Norton's later write-up (4 Sep) notes the last stored email predated the disconnection, so this is retention and continued processing of already-indexed mail, not continued live access. Instinct's terms (as of 2 Sep) state indexed data may still be used after disconnection unless deletion is requested. Unapproved action: Moxxie Ventures founder Katie Jacobs Stanton reported (22 Aug) that Instinct sent an 'innocuous' email on her behalf without checking; she disconnected her email. The product's terms explicitly permit binding 'agreements, commitments, or transactions' without prior approval, so the missing gate is by design. Other tester findings in the same article: Peter Yang could not get Gmail records deleted until a deletion tool shipped; Alex Cohen showed the agent could be phished by email; another tester saw it pull a sign-up code from the inbox to book a Resy table. impact_realized true on the Remoteli principle (the agent acted under delegated authority without approval) and for retained personal data; consequences were minimal. Instinct did not respond to TechCrunch and later told the WSJ it was taking the concerns seriously while raising a $250M Series B. Press-only sourcing, hence medium.",
 "risk_category": "privacy",
 "risk_secondary": [
  "legal_ip"
 ],
 "risk_subcategory": "Unclassified",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": true,
 "agency_reason": "the assistant sent mail without approval and processed retained mail after revocation; retention itself is a data-handling design choice",
 "vector_family": "other",
 "vector_detail": "agent_data_retention_after_access_revocation",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [
   1674,
   1675
  ],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI10",
 "agent_framework": "google_gemini_workspace",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "unsafe_actuation",
 "eai_domain": "agent_behaviour",
 "eai_secondary": [
  "sensitive_data_exposure",
  "confused_deputy"
 ],
 "eai_reason": "impact rule: unsafe_actuation",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI10 (no adversary + unsafe actuation with no attacker-supplied trigger); ASI03 (signal=identity)",
 "submitted_by": "EAI Internal"
}