Instinct put its agent in group chats. The privacy design is the story.

On Monday, Instinct launched group-chat agents to its early-access users, with a wider rollout promised soon. The pitch: add the agent to a chat with friends and let it handle the coordination tax. Travel planning, event tickets, fantasy leagues, carpools, the eternal argument over who is bringing what to Thanksgiving. One Instinct joins and works for the whole group. Notably, it works even for friends who have not joined Instinct. That last detail is the product insight: the agent has to be useful to people who never signed up for it, which means it has to be trustworthy to people who never consented to it.

Instinct is valued at $10 billion as of its latest funding round, per TechCrunch, and the launch is a move in a visible race. Meta's Muse does not yet offer group-chat functionality, though Meta's older Meta AI can be added to group chats across WhatsApp, Messenger, Instagram, and Facebook. Both Instinct and Muse have added phone-call capability in the past couple of weeks. Last week OpenAI launched ChatGPT Dots, personal agents that also work in ChatGPT Spaces, shared workspaces for humans and agents. Everyone is converging on the same idea: the personal agent is becoming a social one.

The interesting part is not the feature. It is the privacy design the founder described, because it is the first serious public attempt at the consent problem shared agents create. On X, founder Noah Shinn laid out the rules: a user's personal agent asks permission before connecting with the group's agent. Users choose which groups they trust and can remove that trust at any time. The group agent is siloed from personal accounts, which it cannot access. The personal agent always asks the user's permission before sharing information or taking any action. And if new members join the group chat, pending replies from a user's personal agent are held rather than shared with the group. All of this is the company's own description of its own product, reported by TechCrunch. It has not been independently verified, and this briefing treats it as a design claim, not a finding.

Still, the design is worth studying because the failure mode it addresses is real and under-discussed. A personal agent knows things: your calendar, your location, your messages, your payment details. The moment it acts in a shared context, every one of those becomes a potential leak. The naive implementation shares first and apologizes later. Shinn's rules invert that: the personal agent defaults to not sharing, asks before each share, and treats group membership changes as a reason to hold, not a reason to continue. "Pending replies held when someone new joins" is a small rule that shows someone thought about the actual attack: you do not even need malice, just a friend added to the chat at the wrong moment.

For builders, the pattern to copy has four parts. Explicit permission before a personal agent connects to a shared context. Revocable trust, per group, controlled by the user. Hard siloing between the shared agent and personal accounts. And conservative behavior on membership changes: hold, do not leak. If you are building consumer agents, multi-user scenarios are no longer an edge case. They are the product. The consent flow is not a settings page. It is the thing that determines whether your agent is allowed in the room.

One caveat, stated plainly: this briefing rests on a single reporting chain, TechCrunch's account of the company's announcement and the founder's posts. The privacy rules are Instinct's claims about Instinct. They are worth copying as design, and worth verifying before you trust them as fact. The company says early-access users can ask their Instinct agent to be put on the list to try the feature. That is as close to a test as this story gets today.