Short Blog.

Every few months something breaks out of the demo phase and starts showing up in my feed from people whose judgment I trust. This month it is Instinct, a personal assistant out of San Francisco that the WSJ covered on Friday (“The Latest Viral AI Assistant Rocketing Across Silicon Valley,”). It is worth a look, not because it solves agentic commerce (it does not), but because it is the clearest example yet of where agentic actually gets traction first, and it is not where the payments industry has been looking.

The advantages of edge Use Cases and SMS…. the biggest breakthrough is happening in categories where there is no cart at all.

What Is Instinct

Instinct is a consumer assistant from Spear Street Technology, founded by Noah Shinn, an early Sierra employee who left Northeastern in 2023. Private beta since February, and per the WSJ it is now raising a $250 million Series B at a $2.5 billion valuation co led by Index Ventures and Benchmark, on top of $350 million raised since 2025 from Conviction Partners and Greenoaks. The venture capitalists funding it are also, notably, among its heaviest users. Take that signal for what it is worth.

The product description on their own site is the interesting part. Instinct connects to your email, messaging, screen, audio and location, and it is “trained to use a phone and a computer” in the same way a human does. There is no new interface. You text it or you call it.

Why “No New Interface” Matters More Than the Model

This is the real distinction from ChatGPT, and it is a distribution insight rather than a technical one. OpenAI asks you to come to a destination, open an app, and start a session. Instinct sits in the channel you already live in, SMS and voice, and it initiates. It follows up on threads you dropped. It calls you.

That is a very different posture. A session based assistant waits to be asked. An ambient one has to know when to speak, which requires context that a chat window never sees. It is the difference between a search box and a chief of staff.

It also means Instinct is doing what I described in Commercial Models for AI Agents as the third economic phase, the consumer controlled agent I called “Siri, reimagined,” except it is running on someone else’s cloud rather than on your device. The context is deep, the trust boundary is not.

How Consumers Are Using It

The reported use cases are telling: responding to emails, managing calendars, booking a ride to the airport, arranging a handyman, shopping homeowners insurance, ordering custom merchandise for a wedding, finding apartment rentals. Shinn told the WSJ someone bought a house on the platform, and that younger users lean heavily on rentals. He describes it as a single place to do almost everything.

The example that went around this week was Kushal Byatnal of Extend, posting that Instinct grabbed him two seats for the Odyssey at the most in demand IMAX in the country when a cancellation opened up at 3:09am. That post did 148,000 views for a reason.

Look closely at that list. Rides, handymen, insurance quotes, apartment tours, a ticket that came free at three in the morning. Not one of them is a retail eCommerce or a SKU. Every one of them is exactly what I mapped out in Agentic’s Real Economic Opportunity: Edge Use Cases: hyperlocal services, custom goods, fragmented supply, markets with no structure and no incumbent to defend them. Transformation seldom starts at the core of an existing market. Instinct is not trying to beat Amazon at product search, which is precisely why it is working.

Worldpay’s consumer research is directionally consistent. In its survey of 8,000 consumers across seven markets (Worldpay, “The Agentic Commerce Report,” November 2025, fielded August to September 2025), openness to letting an agent buy runs highest on cinema tickets (63 percent) and meal delivery (56 percent) under $50, then sports and concert tickets (33 percent) and insurance (27 percent) in the $51 to $100 band, then short haul flights and insurance renewals from $100 to $500. Above $1,000, in Worldpay’s phrasing, confidence collapses. Their summary line is a good one: when the stakes are small, AI earns freedom; when the value or emotion grows, humans take back control.

Which makes the reported house purchase the outlier, not the proof point.

Are They Actually Buying?

Some, yes, and mostly in travel, tickets, and services. That fits the Worldpay curve and it fits the pattern that Autonomous Research described (Kenneth Suchoski, “US Processors & Payments: Where Agents Meet Networks,” October 23, 2025), where repeat purchases with low differentiation and low need to compare move first, and unique, infrequent or hard to return items move last. Worldpay’s respondents expect agents to handle roughly 10 percent of purchases within five years, about 9 percent in the US, which against a $2.9 trillion US ecommerce market in 2030 is north of $261 billion. That is a real number, five years out, and it is a forecast of consumer intent rather than observed behavior.

The key data points I’m looking for to confirm my hypothesis is Instinct’s completion rate. How often does the agent get all the way to a booked, paid, non refunded outcome without a human stepping in? That is the metric. Everything else is a demo.

SIDE NOTE: I’m on w/ Ken and Rahul of Autonomous this Thursday w/ my views on PYPL

What Makes a Good Personal Assistant?

Having watched this category for twenty years, the answer has never been intelligence. It is judgment, memory and taste, and familiar access. A good assistant knows which of your five inboxes matters, which flight you will actually take, which handyman you already fired, and when not to interrupt you. That is context, accumulated over months, and it is why the model that knows you deeply will beat the model that is merely smarter.

This is also the asset that locks you in. As I noted in Commercial Models for AI Agents, the agent itself (its data, training and learned behavior) becomes a highly specific asset that binds the user to a platform. Switching assistants will feel like firing a person who knew everything about you. That is a deeper moat than any model advantage, and it will not be captured by whoever has the best benchmark scores.

Privacy: The Bargain Being Struck

Here is where I get uncomfortable. To be useful, Instinct needs your email, messages, screen, audio and location. The WSJ notes that its terms also allow it to train its AI models on user data. Shinn says they are taking security seriously and have shipped controls to prevent the agent from taking certain actions that early users experienced. I believe him, and it does not change the structure of the bargain.

I have written this line more than once, in Scenario, Agentic Wallets and Federated Data and again in Agentic Commerce, Inevitable or Unworkable?: once you model a consumer, you no longer need the underlying data, just ongoing observation. An assistant that reads your screen and listens to your audio builds a model of you that is far richer than anything Google or Meta assembled from browsing and purchase history. Deletion of the raw data does not unwind that model.

The architecture I argued for in Wallets and Privacy puts the sensitive context in a container the consumer controls, with credentials federated and permissioned out. Instinct is the opposite: full centralization, in exchange for it actually working. Consumers will make that trade, enthusiastically, right up until the first serious breach. Then this becomes a very different conversation.

Worldpay’s consumers already sense it. Their top concerns are identity theft (55 percent) and incorrect or unauthorized purchases (55 percent), and the features that build trust are the mundane ones: fraud protection, the ability to cancel within 24 hours, reviewing purchases before completion, spending limits, and access to a human.

Payments: Too Early to Tell, But Not Too Early to Say What Breaks

Nobody has published how Instinct pays, and I would guess the answer today is unglamorous: stored credentials pushed into a checkout page, plus a lot of humans in the loop. That is model one or model two in Simon Taylor’s useful taxonomy (“Fintech Brainfood: The Four Models of Agentic Payments,” ), and as he put it, the magic completely breaks if you have to manually enter your card information.

But before I list what breaks, I want to flag the thing that is structurally better here.

Could SMS be an Asset over HTTP?

Every agentic payment architecture on the table today is trying to reconstruct trust signals inside anonymous web traffic. That is the whole point of my concern in Device Graph Extinction?: when the consumer stops touching the merchant’s checkout, the device and behavioral data that merchants spent thirty years building their fraud systems around simply evaporates. Machine to machine flows interrupt it. That is the single biggest unpriced risk in agentic commerce.

SMS and voice are not anonymous. They are fully authenticated traffic, authenticated by the mobile operator, and the operator knows things nobody on the web knows: the device, the account that owns the device, the billing address on that account, the tenure of that account, and where the device physically is right now. Instinct chose the one channel in consumer technology that arrives with an identity already attached.

This is not a new idea, it is a twenty year old idea that finally has a use case. I wrote in Authentication, A Core Battle for Monetizing Mobile that mobile operators were uniquely placed to be identity providers, given their distribution, their ability to physically site and verify both the consumer and the phone, and their network level knowledge of where the device is. What was missing then was a relying party that needed it badly enough to pay for it. Agentic commerce is that relying party.

The industry already does this, but only once. As I detailed in Debit, Routing, Tokens and Liability Shift, provisioning a card into a wallet as a DPAN involves an ID&V process with a three way match of consumer, card and phone, with heavy issuer involvement, and it is that ID&V which earns the liability shift. It is a one time event at provisioning, and the assurance it produces decays from that moment forward.

An agent transacting continuously through a phone number needs the opposite: ID&V at the transaction, not at enrollment. A transactional SMS ID&V. Every agent initiated purchase carries a live operator assertion, that the account holder matches the cardholder, that the billing address matches, that the device is where it should be, that the SIM was not swapped this morning, and that assertion gets scored inside the network fraud systems alongside every other signal. That is considerably stronger than a cryptographic mandate self signed by a party bearing no risk, because an operator can be wrong in a way that is measurable, priceable and contractible.

The work required is commercial, not technical. Visa and Mastercard need to bring the operators inside their fraud and certification frameworks, price the assertion, and write the rules that convert it into an authorization rate and a liability position. To borrow Ross Anderson’s line, which I have been quoting for years, if you solve for authentication then everything else is just accounting. The operators hold a piece of the authentication problem that Google, Apple and OpenAI cannot buy, replicate or scrape.

Note who this cuts against. An assistant living inside an app has web grade identity. An assistant living on the carrier network has bank grade identity available to it, if the networks do the deals. That is a real and underappreciated advantage for the text and voice model over the destination app model, and it is the strongest argument I can make that Instinct’s architecture is closer to payment ready than ChatGPT’s.

What Still Breaks?

Three things break as this scales, and none of them are Instinct’s to fix alone.

Intent has no home. A general assistant booking flights, tickets, insurance and rentals is generating exactly the delegation scope that issuers need and cannot see. As I argued in Agentic Data Battle: Intent, intent data must flow to the entity taking the risk, and there should be no self attestation from new parties in a transaction who bear none of it. Instinct is a brand new party asking banks to trust its assertion. Self attestation with an audit trail is not trust, it is hope with documentation.

Composed agents break the delegation chain. Instinct is precisely the “one human, one agent” assumption failing in the wild. A general assistant calling a travel specialist calling a booking agent is a nested chain, and the terminal single hop design in today’s Verifiable Intent specification cannot express it without either making the user sign a mandate per sub agent or having the parent share its keys. Neither is acceptable.

The categories it is winning are the ones with the worst dispute mechanics. Services, tickets and rentals are not returnable. Riskified’s management made this point well (Timothy E. Chiodo, CFA, et al., UBS Securities LLC, “Riskified Ltd: Agentic Commerce Fraud Considerations,” April 2, 2026), noting that fraud is shifting from transactions to accounts and wallets, and that a new class of non fraud chargeback is emerging from agent initiated purchases. When your agent books the wrong Tuesday, who eats it? Target’s answer, covered in Target’s Consumer Terms, “Your Bot Is Your Responsibility”, is that you do. A ticketing platform or a landlord will say the same, faster and with less press coverage.

Wrap Up

Two weeks ago in Agentic Reality: Advertising I argued the first working agentic business model is advertising, because it is the one construct where the merchant keeps checkout, keeps the data, keeps the customer and pays only for measurable demand. Instinct does not contradict that. It sits alongside it, in the half of the economy that never had a marketing funnel to collapse in the first place: the plumber, the IMAX cancellation, the insurance quote, the apartment listing. No retailer to negotiate with, no interchange to fight over, no ad network to disintermediate.

That is why it feels like magic and why the payments questions have not surfaced yet. The transaction has not moved, the liability question is still open, and the industry is still building governance for a shopping cart. Meanwhile the actual consumer breakthrough is happening in categories where there is no cart at all.

The one thing I would put on the networks’ agenda today: go get the mobile operators. Not for a one time provisioning check, but for a transactional assertion that rides with every agent initiated purchase. Of all the trust gaps in agentic commerce, this is the one where the missing piece already exists, is already regulated, is already authenticated, and is simply not under contract.

Worth watching. Also worth asking, before you connect your email, screen and audio to it, what happens to the model of you that gets built along the way.

Feedback appreciated.