Personal AI Agents: Rapid Growth, Layoffs Due to Access Concerns

Early users report having deleted or limited Instinct and, in some cases, Muse, citing incidents and the extent of required access. Meanwhile, Muse claims to have security protections, and Instinct describes controls and limits on data usage. Despite these concerns, Muse claims millions of assets, and Instinct reports significant growth.

Companies: Claimed Protections and Announced Controls

Meta asserts that Muse incorporates privacy, security, and safety protections, with controls allowing users to choose what they share. According to Meta, users select connected applications and authorized actions, can modify or revoke permissions, and permanently delete their data. Muse stores each user's data in an isolated virtual machine, keeps identifiers separate from the AI model, and requests confirmation before significant actions like sending emails or making purchases. Instinct indicates that users can disconnect their Google accounts and delete associated data. The company specifies that it does not use Google Workspace data to train its AI models or to display ads, while reminding users that no system is completely secure and encouraging them to monitor the agent's actions.

Reported Incidents: Unexpected Access and Login Alerts

Users have reported that agents accessed temporary Gmail login codes without requesting permission or hallucinated personal data from an unshared document. Some saw a login request for a carrier account seemingly coming from an IP address in Iran. Mahesh Vellanki, founder of YieldClub, deleted Instinct after receiving a two-factor authentication request linked to an IP address flagged in Iran during an attempt to log into his carrier account. Instinct informed him that it could be a simple IP address tagging issue. Vellanki did not notice any compromise but said he felt very exposed.

Adoption: Muse Dominates the App Store and Instinct Claims Strong Momentum

Muse rose to the top of the App Store a week after its release and currently boasts over 3 million users each week, with more than 1 million logging in daily, according to a source. Instinct has not disclosed its total number of users, but access is by invitation only. According to Shinn, the platform records approximately 10% daily growth and manages an annualized transaction volume exceeding $1 billion, although the user community is described as very limited.

Account Access: Major Barrier for Early Adopters

Several early users explain that they have deleted or restricted their personal AI agents due to the sensitivity of the required data and the extensive access requested. Guto Martino, co-founder of Hermes Agents Brasil, removed Instinct because he does not know where his data goes or what level of privacy he achieves. Scott Persinger, CTO of BizTrip, deleted Instinct despite a favorable review of the product, refusing to entrust his personal email to a young company and believing that access to messaging would allow access to his entire life through password resets. Mahesh Vellanki indicates he continues to use personal AI agents but without providing them with sensitive information.

Usage Practices: Access Restrictions and Local Alternatives

Scott Persinger uses Muse and Grok Bot without connecting them to his email and awaits detailed explanations about the security of assistants before granting them email access. Rami Elghandour, president of Arcellx, deleted Muse after reading reports about unauthorized access to text messages, specifying that he never linked the agent to personal accounts or data and refusing to grant access to all his messages to Meta. He preferred to use an agent he built himself with an open-source model on a Mac Mini, to which he granted access to his email, calendar, and messages, while doubting he would grant such access to a company. Rishi Bhargava, co-founder of Descope, experiments with Muse and Instinct while remaining very cautious, limiting permissions, using Instinct only for low-stakes tasks, and appreciating its interface and asynchronous mode. However, he believes that agent providers do not adequately explain their data handling and protection and desires more transparency regarding security architecture as well as explicit permissions for actions on sites.