AgentsAutonomy & tool use
Instinct raises $1B at a $10B valuation as texting-based AI agents multiply
More than 20 AI agents now work inside iMessage, SMS, WhatsApp or Telegram rather than standalone apps. Instinct, still in private beta, raised $1 billion at a $10 billion valuation, while rivals compete on distribution, agent identity and privacy safeguards.
Reach: not measured yet
AT Pulse research deskPublished · 5 min read · AI-assisted analysisInstinct closed a $1B Series C backed by Sequoia, Benchmark and Coatue at a $10B valuation, about four times its value a month earlier. It reported more than 100,000 private-beta users in mid-September. Reports disagree on the size of its earlier round: one source puts it at $350M and others at $250M. [2] [7] [1] [5]
Messaging platforms act as gatekeepers. Apple approved Poke as the first AI agent on Messages for Business only after it showed it offered live human support and clearly labeled itself as AI. Cognition later bought Poke to bring its conversational style to Devin, which suggests interaction design is becoming a competitive asset. [3] [4]
Rivals compete on trust and on giving the agent its own identity. Tab has its own phone number, computer and wallet, and it requires approval before irreversible actions. Ollie logs in through its own cloud browser so it never handles user passwords. Underdog runs a 27B reasoning model fine-tuned from Qwen entirely on the user's device. [8] [9] [12]
Testers found that Instinct kept Gmail data, kept summarizing an inbox after access was revoked, could be steered by phishing emails and sent an email without approval. Instinct and Meta's Muse have since added phone calls without disclosing safeguards or saying whether call recipients are told they are talking to an AI. [5] [6]
Tester findings show that agents with inbox access and the ability to act can be steered by phishing and can keep working after access is revoked.
Read the full assessment
For builders, this means treating inbound email as untrusted, requiring approval for outbound actions and fully deleting data on disconnect.
Executive brief
Instinct, a texting-based personal AI agent that is still in private beta, raised a $1 billion Series C at a $10 billion valuation. That is four times the valuation it had a month earlier (PYMNTS). TechCrunch's roundup lists more than 20 rivals. These agents work through iMessage, SMS, WhatsApp or Telegram, so users don't need a separate app. Within this category, competition is moving away from the underlying models and toward distribution, the agent's own identity (phone number, email address, payment card) and trust. Instinct's early privacy problems show how weak that trust can be.
What changed and event timeline
Apple admits an AI agent to Messages
Apple approved Poke as the first AI agent on Messages for Business. Poke first had to show it offered live human support and labeled itself clearly as AI ().
Cognition buys Poke
The coding-agent company bought Poke's parent in a deal valued in the low nine figures, to bring Poke's conversational style to Devin ().
Instinct's privacy problems become public
Testers reported that the service kept Gmail data, kept summarizing an inbox after access was revoked, could be manipulated by phishing emails and sent an email without approval ().
Agents start placing phone calls
Instinct began offering calls to some users in early access. Meta's Muse added outbound calls to U.S. businesses ().
Instinct is valued at $10B
The $1B Series C was backed by Sequoia, Benchmark and Coatue (;).
Two privacy-focused launches
Underdog opened an invite-only beta that runs fully on the user's device (). Tab came out of stealth at a $300M valuation ().
Capabilities and access
- Instinct: handles requests by text or voice and connects to email, calendar and Google Workspace.
- Tab: works over iMessage and WhatsApp, with its own phone number, computer and wallet (TechCrunch).
- Underdog: runs on Mac and Windows, with Linux and mobile planned (TechCrunch).
Read the full section
- Instinct: handles requests by text or voice and connects to email, calendar and Google Workspace. Each assistant has its own email address and can place calls. Private beta with more than 100,000 users as of mid-September (PYMNTS).
- Tab: works over iMessage and WhatsApp, with its own phone number, computer and wallet (TechCrunch).
- Underdog: runs on Mac and Windows, with Linux and mobile planned (TechCrunch).
- Pricing in the roundup: from free tiers up to $100 a month (Ollie, Pally) (TechCrunch).
- Most vendors don't say which models they use.
Technical analysis for researchers and developers
- On-device inference: Underdog uses a 27B-parameter reasoning model fine-tuned from Qwen3.8-27B. Account keys are encrypted and no cloud is involved (TechCrunch).
- Shared open-source base: Iris is built on Hermes Agent, Nous Research's agent framework (MIT license).
- Credential isolation: Ollie logs in through its own cloud browser using remote-session links, so it never handles user passwords (TechCrunch).
Read the full section
- On-device inference: Underdog uses a 27B-parameter reasoning model fine-tuned from Qwen3.8-27B. Account keys are encrypted and no cloud is involved (TechCrunch).
- Shared open-source base: Iris is built on Hermes Agent, Nous Research's agent framework (MIT license). It stores sessions in SQLite with FTS5 full-text search plus LLM summaries for memory, and it turns tasks it has solved into reusable skills (DataCamp; readthedocs).
- Credential isolation: Ollie logs in through its own cloud browser using remote-session links, so it never handles user passwords (TechCrunch). Wajo's agent and Tab each have their own identity, as above.
- Evaluation: none of the reviewed sources includes benchmarks or reproducible task-success evaluations.
Claims and evidence
- Instinct's earlier round is reported inconsistently. The roundup says $350M at $2.5B (TechCrunch). TechCrunch's August article and PYMNTS say $250M (TechCrunch; PYMNTS).
- Poke's "about 100 million messages relayed" is the company's own figure (TechCrunch).
- Szn's numbers (7,500 businesses, 10,000 jobs) come only from its own website, as cited in the roundup.
Read the full section
- Instinct's earlier round is reported inconsistently. The roundup says $350M at $2.5B (TechCrunch). TechCrunch's August article and PYMNTS say $250M (TechCrunch; PYMNTS).
- Poke's "about 100 million messages relayed" is the company's own figure (TechCrunch).
- Szn's numbers (7,500 businesses, 10,000 jobs) come only from its own website, as cited in the roundup.
- Ollie's SOC 2 Type II is an independently audited control framework. It says nothing about how well the agent performs (TechCrunch).
Context and prior work
- Messaging became a distribution channel through platform decisions: Apple's approval of Poke (TechCrunch), and the EU fee changes that opened WhatsApp to third-party agents.
- Hermes Agent launched in February 2026 and is a common open-source base (readthedocs).
- Cognition bought Poke for its user-facing "personality," not its models. That suggests interaction design is now treated as a moat (TechCrunch).
Read the full section
- Messaging became a distribution channel through platform decisions: Apple's approval of Poke (TechCrunch), and the EU fee changes that opened WhatsApp to third-party agents.
- Hermes Agent launched in February 2026 and is a common open-source base (readthedocs).
- Cognition bought Poke for its user-facing "personality," not its models. That suggests interaction design is now treated as a moat (TechCrunch).
Limitations, safety and contested findings
- Instinct's terms of service: testers flagged a "perpetual and irrevocable" license to user materials and permission to enter binding agreements on the user's behalf.
- Calls: neither Instinct nor Muse has disclosed safeguards or whether call recipients are told they are speaking to an AI (TechCrunch).
- Reliability: Poke had technical problems shortly after its iMessage launch (9to5Mac).
Read the full section
- Instinct's terms of service: testers flagged a "perpetual and irrevocable" license to user materials and permission to enter binding agreements on the user's behalf. Testers also found emails stored in plain text and showed the agent could be steered by phishing (prompt injection by email). Instinct told the WSJ it takes these concerns seriously (TechCrunch).
- Calls: neither Instinct nor Muse has disclosed safeguards or whether call recipients are told they are speaking to an AI (TechCrunch).
- Reliability: Poke had technical problems shortly after its iMessage launch (9to5Mac).
Business and practitioner implications
- Trust is how these products compete. Ollie sells SOC 2.
- Builders should treat inbound email as untrusted input.
- Apple's requirements (human support, AI disclosure, a style guide) and per-user messaging fees shape both unit economics and launch timing.
Read the full section
- Trust is how these products compete. Tab requires explicit approval before irreversible actions and says it doesn't train on user data (TechCrunch). Ollie sells SOC 2. Underdog sells local inference.
- Builders should treat inbound email as untrusted input. They should also gate any outbound actions and support real deletion when a user disconnects an account.
- Platform gatekeeping matters. Apple's requirements (human support, AI disclosure, a style guide) and per-user messaging fees shape both unit economics and launch timing.
- The field is crowded and funding is concentrated. Expect consolidation along the lines of Cognition buying Poke.