CEO Deletes Instinct Account After Phishing Test
Alex Cohen tested Instinct on his Gmail and deleted the account after a phishing simulation succeeded.
Alex Cohen, founder of Hello Patient, used the Instinct AI assistant for two days to handle tasks like shopping for insurance, booking medical appointments, and searching travel options. He then created a separate Gmail account and sent his main inbox a message directing the AI to extract and forward private details. Instinct processed the request but later suggested a verification step. Cohen cited the lack of safeguards around read and write access as the reason he closed the account.
Just nuked my Instinct account. Tried it out for 48 hours and it does feel like the future of personal AI assistants (had it shop for new homeowners insurance, book a doctor's appointment online, search for travel, manage my LinkedIn notifications). I'm just... not yet…
Reactions from ranked influencers
5 postsFor additional context, I don’t think we’re at the point where it’s safe to give AI read/write access to your inbox. I wanted to see how easily Instinct could be phished, so I created a brand new Gmail account and emailed my real personal account with instructions for Instinct…
Just nuked my Instinct account. Tried it out for 48 hours and it does feel like the future of personal AI assistants (had it shop for new homeowners insurance, book a doctor's appointment online, search for travel, manage my LinkedIn notifications). I'm just... not yet…
Increasingly true and terrifying!
Products like Instinct and Grok Bot are going to change modern security norms for consumers. People will increasingly hand over passwords to 3p apps, unaware of how or what they are storing for them. Simultaneously an incredible functionality unlock and security nightmare.
@anothercohen read access is fine, auto write is a huge security challenge.
@anothercohen One of the reasons we keep working on a version you can run fully local. And now the smaller models are getting good.