Instinct Runs Inside iMessage. There is no app to open.

On September 28, 2026, Instinct raised a $1 billion Series C at a $10 billion valuation from Sequoia Capital, Benchmark Capital and Coatue. One month earlier the same company had raised $350 million at $2.5 billion. It has no mobile app. To use it, you text it.

That is the entire interface. Instinct has its own phone number and its own computer, and it reaches you over iMessage and SMS. Founder Noah Shinn's design claim is that there are no new interfaces: you text it or you call it, and it has been trained to drive a phone and a computer the way a person does. It has been invite-only since August 2026. There is no published price.

For a CEO the interesting part is not the valuation. It is that a company with no app, no download and no dashboard has become one of the most-discussed consumer AI products of the year, and that everything it can do for you is a function of what you connected on day one.

Onboarding is the product

Setup connects your iMessages, your Google Workspace and your MCP servers. Peter Yang reviewed it in August and singled out that step specifically, not the model behind it.

Reach kept widening through September. On September 4 came a 1Password integration, with Shinn stating that 32% of users already share credentials with the agent through its Vault. On September 8 every Instinct got its own email address, which Shinn framed as the first step toward the agent owning and running its own accounts. On September 16 came Instinct Concierge, which handles phone calls and bookings, described as a white glove service for cases like the restaurant that takes no online reservations. Read that phrase carefully: white glove is human-in-the-loop language, and nothing in the announcement says the calls are made by a model. The autonomy level is deliberately unstated.

Then the agents started talking to each other. On September 23 Shinn reported that Instincts had coordinated over 300,000 times in the week since the Instinct-to-Instinct network launched. Commerce followed: a Stripe payments partnership in August, a Shopify partnership on September 28 that pulls product discovery, checkout and order updates into the same message thread.

Sarah Guo named the thing that actually changed, and it was not capability.

The numbers it publishes, and the one it does not

Instinct publishes ratios and event counts. It does not publish a denominator.

Alongside that: 35% of users use it for personal shopping, 32% share credentials through the Vault, 300,000 coordination events in one week. Every one of those is a share or a count of an undisclosed base. TechCrunch, reporting the $10 billion round, put it flatly: the company "has also not shared its user numbers or any growth metrics." The one compounding growth figure in circulation, roughly 10% a day, came from podcast host Patrick O'Shaughnessy promoting his own interview, not from the company. Do not quote it as Instinct's number.

What Shinn did publish is the growth mechanism, and it is more useful than a rate: an invite program where every new user is onboarded by a close friend or family member. That is a deliberate trade of speed for trust, which is a coherent choice for a product that reads your messages.

The memory is markdown files and grep

Dhravya Shah, founder of Supermemory, spent three days probing the iMessage surface and published a reconstruction of how Instinct remembers you. Before anything else, his own caveat, because it governs everything that follows.

This is black-box inference. No vendor confirmation, no source access, no independent replication, and the piece doubles as a pitch for Shah's own memory product. Treat the shape as well evidenced and each number as his measurement.

With that held: the store is git-tracked markdown files, typed as preference, person, organization and conversation, with facts kept as lists and wiki-style links joining files by ID. Retrieval uses no vector index and no BM25. It is keyword matching, grep-style, through bash-like tools. Per turn the answering model gets roughly a 4,250-token profile in three sections, Life context, Autonomy calibration and Channel communication style, plus about 10,000 tokens of compacted conversation.

Two details matter more than the rest. Memory is read-only to the agent: a separate background process does the merging, on a roughly daily cron. And there is no automatic forgetting. A permission boundary enforced by architecture rather than by instruction is a design most enterprise AI programs talk about and do not build. A $10 billion company built its memory layer out of plain text files and grep, and shipped the boundary.

The benchmark, read properly

Assistant Benchmark v0.2, published in mid-September, scored 108 assistants across 15 dimensions over 180 runs. Muse came first at 9.1, Instinct second at 8.4, Grok Bot at 7.3. That ordering travelled widely and it is not a like-for-like result: Muse was scored on only 7 of the 15 dimensions, against Instinct's 11. A higher score on fewer axes is a different claim from a higher score on the same axes. If you are using this table to pick a vendor, the footnote is the finding.

Two failures worth more than the round

Claire Vo disconnected Instinct from Google at 11am and still received an email summary at 2pm. Gergely Orosz used it to flag the systemic problem with agent startups: the connect action grants more than users believe and the disconnect action revokes less. The memory findings above explain the mechanism. A reconciler on a daily schedule does not notice that you revoked access three hours ago.

The second failure is newer and worse. On September 23 a user reported that Instinct had told him it leaked another person's data into his chat, describing a financial document that was not his. Shinn's response was first-party and specific.

The mechanism is the part to take to your own company. The model invented a token that looked like a real entity. Its own reasoning trace then treated that token as evidence, because a reasoning trace is text the model conditions on, not a verified log. Reasoning over a fabrication produced a coherent story, and the story was an incident report about itself. The user's report was entirely honest. He was told there had been a leak, by the system that would know.

Note also that only the vendor's account of this exists. Nothing external adjudicates it, and a company whose memory store is a git-tracked dossier on the people in your life is exactly the company whose denial a sceptic will not accept.

Three things follow for anyone deploying agents inside a business. A visible chain of thought is an amplifier, not a check. A false breach report costs roughly what a real one costs, because nobody downstream can tell them apart. And the rule that falls out of both is short enough to put in a contract: an agent may never be the sole author of a statement about its own compliance.

Ask the system, not the agent.