Instinct AI teardown: the agent inside your messages

Lives in your messaging apps rather than in a new interface.

Every other personal agent starts by asking you to open something new. Instinct doesn't, and that one decision explains most of what's odd about the way it's built.

The web app isn't where the product lives

Your conversation happens in WhatsApp, or over SMS, or in iMessage, or at an address on a mail domain the product hands you. There is a web app. It's an admin panel. On the account we looked at, the chat route inside it was switched off at the feature-flag level and bounced you back to the workspace view; the desktop build was gated the same way.

So there's no window to open, no new habit to build, and no place for you to go looking at what the agent was told. The flip side is that Instinct has to work in a medium with no buttons, no side panel and no way to show you a half-finished thought. Everything it wants to tell you has to survive as a text message.

A command line where everyone else ships a function list

Most agents hand the model a list of functions with typed parameters. Instinct hands it a shell instead. Every capability arrives as tools <namespace> <action>, one surface covering delegation, to-dos, mail, the messaging channels themselves, a cloud browser, an indexed data store you can run SQL against, and the alarm clock that wakes it up.

Counting that surface is where it gets interesting, because three different numbers are all true.

The product's own help index reports 43 tool families and 571 actions. Our pass over the same index came back with 39 families and 569 actions. Once you add the ones that exist on live pages but aren't listed separately, we registered 577 distinct action names. Of those, 335 gave up a complete manual page. The other 242 each have a stated reason: an integration you haven't connected answers a help request with one status line and never reveals its usage, some actions are preloaded for a role rather than published, some return output that stops short. Nothing in that gap is unexplained. That isn't the same as saying all 577 are reachable by you.

The manual is mandatory, and the model pays for it

Before an action runs for the first time, its help page has to be fetched. That's not a convention the model follows when it feels like it; it's enforced. Skip the read and the call fails, and the failure shoves the manual into the context anyway.

This is a good design, and it isn't free. On the credit side, the model can't invent a parameter that doesn't exist, and a rarely-used action behaves the same on its first call as on its hundredth. On the debit side, the documentation *is* the prompt. A job that touches six unfamiliar actions pays for six manual reads before any work happens, and that budget comes out of the same context window the conversation lives in.

Where the work actually happens

Delegated tasks run in a Firecracker microVM from E2B. We confirmed that one directly. The sandbox takes outbound connections and accepts no inbound logins, and browser work goes to a leased cloud instance rather than the Chrome on your desk, though that instance can use sign-ins you've saved.

The main agent is a different story. It has a shell, subject to the same time limit and content filtering; it writes files and reads them back several turns later, so something durable is underneath it. We never captured anything that identifies the machine, so we're not going to tell you it's the same kind of sandbox. It might be. We don't know.

Memory: three stores, three different jobs

There's a git-tracked set of markdown files, which is the part people notice. There's a separate layer of indexed connector data, sitting behind a query interface rather than a chat box. And there's a credential vault built to fill and never to reveal: the agent can type your card number into a checkout form without being able to read it back to you or to anyone else, and passwords don't travel through the messaging channel at all.

Worth knowing that we're not the only ones who went looking. On 20 September the founder of supermemory published an independent teardown of the memory layer, reached entirely by probing the iMessage surface, and landed on the same shape from the outside: markdown under version control, keyword lookup rather than vector search, reconciliation running roughly once a day. That post cleared 280,000 views. Two teams poking at the same product from different angles and agreeing is worth more than either of us saying it alone.

It wakes itself up

Instinct doesn't only answer. A clock can start it, and so can an event on your mail, your calendar, your documents or your location. The platform runs its own safety check before a wake turns into action, which is the sort of detail nobody puts on a landing page and everybody should ask about.

What we couldn't establish

[TODO 保留本节，上线前逐条复核]

• The body of the main instruction set. It runs to 27 sections; only their headings ever surfaced.
• Which host the main agent runs on. See above.
• The production model id. Nothing on the client names it.
• The schema behind the control plane. Introspection is turned off.
• The desktop app. An account flag keeps it shut, so we never saw it run.

Pricing

[TODO 数据从 data/pricing.json 读，带 as-of 日期渲染。上线前核一次。]

How Instinct scores

[TODO 接 /how-scoring-works 的五条轴，等 data/scorecard.json 定稿后填]

• 执行位置
• 工具暴露方式
• 记忆载体
• 渠道入口
• 我们没测到什么

The five axes

Where it runs

Server orchestration with work running in a sandbox. Browser tasks use a leased cloud browser, not the Chrome on your desk.

How tools are exposed

A command-line surface rather than a function list: 43 families and 571 actions by the product's own count, and three different totals depending on who is counting. An action refuses to run until its own help text has been read, which makes the manual part of the prompt.

Where memory lives

Three stores that do different jobs: a read-only markdown set, an observation log, and a fill-only vault for secrets.

How you reach it

Messaging first. WhatsApp, SMS and iMessage are the default surface, plus an address on its own mail domain. The web app is mostly an admin panel.

What we could not establish

The body of the main instruction set (only its section headings surfaced), which host the main agent runs on, the production model id, and four named policy sections we found pointers to but never text for.

The other three

• PinePhones companies on your behalf about bills, refunds and cancellations.
• MuseMeta's personal agent, with a Linux machine of your own behind it.
• TownWeb and native Mac, with a real foothold on the machine itself.

Compare all four on the scorecard, read how we score, or see why the existing agent benchmarks don't answer this.