Instinct Can Build AI's Next Great Moat

01 — What happened

Instinct is a personal AI assistant built by Spear Street Technology and led by Noah Shinn, a 23-year-old former Sierra researcher. On 26 August, the company said it had raised a $250 million Series B co-led by Benchmark and Index Ventures. The round brought total funding to $350 million and valued the company at $2.5 billion.

An early round reportedly valued Instinct at $50 million. In early August, Kleiner Perkins led a $75 million Series A at more than $500 million. A few weeks later, that valuation had increased fivefold, even though the product was not public and still required an invitation.

The product itself explains some of the excitement. Instinct connects to email, messaging, calendars, your screen, audio, location, and other applications. You call or text it. It follows up on conversations you dropped, books a table, arranges a ride, finds a flight, buys something, or calls a service provider. Instinct says it is trained to use a phone and computer the way a human does.

That is a long way from waiting for a question inside a chat tab. Instinct acts, and its actions have consequences.

02 — The first wave found its moat later

Replit, Lovable, Bolt, v0, and dozens of similar products made up the first big wave of applied AI. Type what you want and get an application, interface, or piece of code.

They changed who could build software. They also had an obvious product shape that competitors could reproduce. The models were available to rent, the loop was visible, and the early versions were mostly a text box with a generated artifact on the other side. Quality varied, sometimes a lot, but the basic experience spread quickly.

There was not much of a moat in that interaction at the start. Distribution became the moat.

The winners accumulated users, brand, community, templates, deployed projects, and eventually habit. They became the first place people went when they wanted to build something. That is a real advantage now, one that a fresh competitor cannot copy with a weekend prototype. But the advantage came after launch. It grew with usage.

That shaped the whole category. Products appeared quickly because they could be built quickly. Competitors followed for the same reason. Most of them rented intelligence from the same handful of model providers, so winning came down to who could reach users and become the default fastest.

03 — Why Instinct is different

A personal assistant is much harder to reproduce than a prompt-to-code loop. It has to observe what is happening, remember what matters, make a plan, ask for permission, take action, recover when something fails, and occasionally have the sense to leave things alone.

We talked about this years ago while I was co-founding CodeAddress. People did not want more software to operate. They wanted a smart assistant. The demand was clear, but the technology was nowhere near ready.

Models have finally made the idea believable. They have not made the product easy.

A coding tool can turn one request into one artifact. A personal assistant works across messages, people, dates, permissions, preferences, websites, payments, and half-finished conversations. Each integration collides with the ones already there. Email plus calendar is not two connectors. It creates combinations of intent, identity, timing, authority, and changing state. Add payments and those combinations can cost money. Add proactive behavior and the assistant must judge when it is useful to interrupt you.

The complexity grows at least quadratically. In parts it may be exponential.

Replit, Lovable, and Bolt had to turn distribution into a moat. Instinct can arrive with one already taking shape in the depth of its integrations and in the difficulty of making the whole system behave.

04 — One text thread, several companies underneath

The interface is almost aggressively simple. You send a message. Instinct gets something done. Most of the company disappears behind that exchange.

An assistant working across the web needs durable sessions, isolated credentials, browser and device automation, queues, retries, idempotent actions, audit logs, and observability. If a third-party interface changes halfway through a task, it needs to recover. If a purchase fails, it needs to know whether to retry, ask for help, or stop before charging the user twice.

It also needs continuous penetration testing. Ordinary application security is only the beginning. The assistant has to deal with prompt injection, malicious documents, poisoned webpages, account takeover, and instructions that try to cross permission boundaries. Each connector opens another attack surface. More autonomy means a larger blast radius when something goes wrong.

Then comes automation behind the assistant: continuous evaluations, adversarial test suites, task replay, automated permission checks, anomaly detection, and human escalation. A text thread sits on top of an operations company, a security company, and a distributed systems company.

A competitor can rent the same model and copy the interface. It cannot instantly copy the infrastructure, integration behavior, failure data, security work, and ugly little fixes collected from millions of real tasks.

Generation was the hard part of the first wave. Reliable agency is the hard part of this one.

05 — Trust is engineering

Early users were reporting security and privacy problems during the same week that Instinct became a funding sensation. One tester said it sent an email without asking for confirmation. Another said it booked a restaurant with a $200 cancellation fee after being asked to find availability. A phishing test reportedly showed that instructions planted in an email could influence the agent.

Users also found that disconnecting Gmail did not delete emails Instinct had already indexed. The company later added a control for deleting external data.

For most software, these would be beta bugs. For an assistant, they are the product problem. A writing tool can hallucinate a paragraph. An agent with delegated authority can send a message, make a purchase, accept terms, or damage a relationship before you know it has made a decision.

Instinct's current terms spell out how broad that authority can be. Users authorize it to access, copy, collect, and index data from connected services. They allow the service to take actions it considers responsive to their instructions. They also appoint it as their agent to enter agreements, commitments, or transactions on their behalf, binding the user as if they had done it directly.

Privacy language alone will not solve this. The permission model has to understand consequences. Reading a restaurant confirmation and cancelling the booking should not sit behind the same checkbox. Neither should drafting and sending an email. Finding a flight, reserving it, and paying for it need separate thresholds.

A good agent should slow down before an irreversible action. It should show what it plans to do and explain what triggered the decision. Afterwards, you should be able to inspect the full trail. Content inside an email needs to be treated as untrusted data, and revoking access should be immediate and easy to understand.

That friction is part of the product. If Instinct learns when to act, when to ask, and when to stop, it will collect operational knowledge that does not come with a model API.

06 — How the moat compounds

Instinct's first advantage is the system itself: integrations, orchestration, security, automation, recovery, and the knowledge required to execute tasks across an internet built for humans.

Personal context adds another layer. The assistant sees that your flight moved, remembers the dinner you promised to arrange, knows which card you normally use, and learns that you hate the 6 a.m. departure. Once it can act on those details, the underlying model is no longer the most interesting part of the product.

Leaving means teaching another system your preferences, routines, relationships, and exceptions. Then you have to trust it with the same authority. Exporting a file will not recreate any of that.

Distribution makes both advantages stronger. More users bring more tasks, failures, recovery paths, and permission decisions. If the team learns from them, the system gets better and earns more authority. More authority produces harder cases, which give the team more knowledge.

It can also go the other way. More usage can expose more failures and kill trust. But if Instinct gets reliability right, distribution will deepen an existing moat instead of creating one from scratch.

The first wave used distribution to defend a copyable product. Instinct can use distribution to deepen a product that is already hard to copy.

That theory explains the $2.5 billion valuation better than the waitlist does.

07 — What could break it

Technical difficulty does not guarantee a defensible company. Sometimes a complex product is just an expensive collection of incidents.

The model labs can build assistants too. Apple and Google own the devices, identity systems, and operating-system permissions Instinct needs. Third-party services can block automated access. One serious security failure can wipe out years of trust. Without a sustainable business model, a personal assistant may eventually have to choose between the user's interests and the value of all that private intent.

The waitlist will not tell us whether Instinct has a moat. These will:

1. Can it add integrations without reliability dropping as the combinations multiply?
2. Does it ask for confirmation based on risk, staying quiet for reversible work and stopping before messages, purchases, cancellations, or commitments?
3. Can its penetration testing and security model keep up with the attack surface?
4. Can users inspect, correct, and delete what the assistant remembers?
5. Will Apple, Google, OpenAI, or Anthropic restrict the access a neutral personal agent needs, or build the same product at the platform layer?

The valuation proves nothing. It prices a theory: the next great application-layer moat in AI will come from the system that can turn rented intelligence into reliable action.

The first wave made software from prompts, then turned distribution into defensibility. The next wave will work across our lives and inherit a much higher technical bar.

Instinct might be the first company over it.