AI agent trust – PJFP.com

Noah Shinn started Instinct about a year ago, and in his first long-form interview about the company he sat down with Patrick O’Shaughnessy on Invest Like the Best to explain how an invite-only personal AI assistant with no app and zero marketing spend is growing roughly 10% a day. Instinct has its own phone number, email address, and computer. You text it, call it, or email it, and it acts for you anywhere on the internet. The conversation runs from wild user stories to trust metrics, the business model, the coming fight between agents and incumbent apps, and the brutal math of buying compute for a product that doubles every week.

TLDW

Instinct is “just a personal assistant” reached through iMessage, WhatsApp, voice calls, and email, backed by its own computer so it can do anything a person does online. Users have it plan outfits from scanned wardrobes, cancel forgotten subscriptions end to end, coordinate group outings and shared Ubers, and book whole trips from a single voice note. A new trusted person network lets two users’ agents negotiate meeting times directly, with weighted access levels and real social consequences when trust is broken. Shinn says 40% of users share a credit card within three weeks and users who share one sensitive credential retain at about 80%. More than $1 billion a year in transaction volume already flows through the platform, half of it travel, and he plans to monetize with a merchant take rate somewhere on the curve between Stripe and Apple rather than ads, arguing that an agent smarter than its user must never be paid to persuade them. He splits every business into attention revenue and service revenue, predicts that zero-friction agents will grow service businesses like Uber and DoorDash while squeezing attention businesses, and describes staged A/B experiments with early partners. The back half covers designing for understandability over capability, eval and rollout process, the compute problem he spends 40% of his time on (several month lead times while demand doubles weekly), serving Opus 5 level quality at a fraction of the cost through custom inference deployments, why a natively proactive agent will need orders of magnitude more tokens than coding tools, firewalls and decoupled watchdogs against prompt injection and hallucination, his view that all software collapses into one simple interface, the move from tasks to long-running objectives, the name, channel risk, and the roughly $1 billion raise at a $10 billion valuation.

Thoughts

The most useful number in the interview is not the 10% daily growth. It is the trust curve around the 24 minute mark: roughly 40% of users hand Instinct a personal credit card within three weeks, and anyone who connects even one sensitive credential retains at around 80%. Shinn treats time to first credit card, first password, and first sensitive document as proxies for trust and as the real north star. That reframes what a consumer agent company is optimizing. Capability is table stakes. The product is the slow accumulation of permission, and the moat is a user who has already done the uncomfortable thing of handing over their inbox, calendar, and card. A competitor with a better model still has to earn those three weeks again.

The business model section (roughly 28 to 37 minutes) is where the interview is most interesting and where it deserves the most scrutiny. Shinn’s case against ads is strong: an agent that is more socially intelligent than you and gets paid by brands to change your behavior is a genuinely dangerous product. His alternative is a take rate on the more than $1 billion of annual transaction volume, benchmarked against Stripe at the low end, Amazon around 10%, and Apple at 30%, with boutique hotels already offering up to 30% for delivered bookings. But a take rate is also an incentive. The moment one hotel pays Instinct 30% and a better fit pays 10%, the agent faces the same conflict an OTA does, just hidden behind a friendly text message. Shinn’s answer is that Instinct pursues higher level objectives like the user’s trust rather than completing tasks, and he wants a blanket, uniform take rate. Whether the rate truly stays blind to which merchant gets picked is the thing to watch as this scales.

The framework in the middle of the conversation (38 to 48 minutes) is a clean way to think about which companies agents hurt. Split every digital business’s revenue into the part earned from user attention in the app and the part earned by delivering the underlying good or service. The naive view says a 70% attention, 30% service business shrinks to 30%. Shinn argues the service slice grows, because every removed click historically increased transaction volume, and an agent that has a car waiting because it owns your calendar, or offers your usual dinner as your flight lands, pushes friction to literally zero. That is a sharp, testable claim: Uber and DoorDash may end up as winners of agentic commerce while businesses built on infinite scroll lose the most. His proposed playbook for incumbents, running agent access on 1% of users as an A/B test before committing, is also more practical than the “agents will destroy apps” rhetoric that usually surrounds this topic.

The compute discussion around the hour mark is the part nobody else has really written up, and it is the best explanation yet of why fast-growing agent companies are so capital hungry. Compute has a lead time of several months. Buy it on the spot market and you pay three or four times the price. At 10% daily growth demand doubles about every week, so buying 2x is gone in a week and 10x is gone in a few weeks. Even if growth slows to 5 to 8% a day, compounding over a three to four month procurement window lands near 100 million users. Every purchase is a large leveraged bet where being wrong costs 3 to 4x. The offset is inference engineering. Shinn claims Instinct matches Opus 5 level engagement and eval results at a very low cost, largely because most of an assistant’s work does not need a response in hundreds of milliseconds. Batch workloads that can finish in minutes or hours run on deployment shapes 3x to 8x more efficient, and those gains compound. That is a real structural advantage over a product that routes everything through a frontier API at a blanket price.

The final stretch ties it together. Instinct is “almost natively proactive”: it wakes at 6 a.m. to prepare your day, decides whether to stay quiet, and wakes again at 4 p.m. when it spots something useful. Only a small fraction of its work is interactive, which is why Shinn expects this category to need orders of magnitude more compute than coding tools, where a human prompt starts every loop. That same background autonomy is why the safety architecture matters: content firewalls on everything coming in, and a monitor decoupled from the agent’s own incentives that can pause any action or catch a hallucinated proper noun before a tool call runs. It also explains the roughly $1 billion raise at a $10 billion valuation. Shinn says the easy path is a $100 a month subscription, and he calls that a local optimum. Venture capital is buying the time to prove a free, take rate model before the incumbents with billions of users catch up. The risk he downplays is channel dependence on iMessage and WhatsApp, though he notes over half of traffic already runs off iMessage, and the bigger question is whether being “the product that just works” survives once the largest platforms ship something close enough.

Key Takeaways

Instinct is roughly a year old and Noah Shinn describes it plainly as a personal assistant, refusing to dress it up as anything more exotic.
There is no app. Instinct has its own phone number, email address, and computer, so users text it, call it, or email it, and it can call them back when something is urgent.
Shinn argues this is a different kind of consumer launch because people already know what AI should act like. That expectation has existed since people first used ChatGPT in 2023.
Its social awareness shows in small moments, like calling a user at 2:55 p.m. about a document that must be signed by 3 p.m. and offering to bump the email to the top of the inbox.
One recurring use case is scanning an entire wardrobe plus the user’s own body, then having Instinct plan a week of outfits shown as images of the user wearing them.
The same capability extends to shopping: thousands of outfit options, three fresh head to toe looks a day, and one-message ordering.
With bank accounts connected, Instinct finds unused subscriptions, logs in, handles email confirmations, cancels them end to end, and reports back how much the user saved.
Patrick O’Shaughnessy’s reaction: any product that depends on consumer laziness or inertia is toast.
The trusted person network, about ten days old at recording, lets two users’ Instincts negotiate meeting times directly instead of the usual back and forth.
Connections carry different access levels. Spouses often share everything, while a colleague might see only a work calendar and specific documents.
Shinn describes the network as a graph with weighted edges rather than a flat friend graph, which creates a new kind of network effect.
If a connection starts probing for data beyond their access, the user’s Instinct tells them, and the breach of trust has real social consequences.
One friend group of six has Instinct plan a creative outing every week using their availability and Spotify tastes, then route a single shared Uber to pick everyone up.
Agents change restaurant reservations from first come first served to matching. A spouse’s 30th birthday can be surfaced and prioritized by restaurants that want special occasions.
More than $1 billion a year in transaction volume already flows through Instinct on a very small invite-only user base, and about 50% of it is travel.
A single voice note like “I need to be in New York tonight” results in flights, seat and meal preferences, card choice, hotel, Ubers on both ends, and calendar entries.
Preferences stated once are remembered and extrapolated to other bookings, so the assistant gets easier to use over time.
About 40% of users share a personal credit card within three weeks. Time to first card, password, or sensitive document is treated as a proxy for trust.
Users who connect at least one piece of sensitive information retain at about 80%, which O’Shaughnessy calls crazy for consumer technology.
A core principle is that users stay in control of their data, share at their own pace, and can revoke access at any time.
Security has two layers: the tractable problem of storing sensitive data safely, and the new agent-specific attack surface that needs new systems.
Every incoming piece of content passes through firewalls that can block malicious instructions, and every action or thought is watched by a monitor decoupled from the agent that can pause or reject it.
Shinn does not want Instinct influencing user behavior against the user’s interests, and he calls an ad-funded agent smarter than its user a dangerous reality.
Instinct is designed to pursue higher level objectives like building trust and watching the user’s back rather than blindly completing tasks, which makes it more robust to bad requests.
The planned model is free for users with a blanket merchant take rate, compared to Apple Pay, where users pay nothing and merchants pay for access to distribution.
Payment rails share roughly 2 to 2.5% across many players. Shinn is not chasing basis points there but a spot on the curve from Shopify and Stripe through Amazon’s roughly 10% to Apple’s 30%.
Travel is the natural starting point because hotels, especially boutique ones, already pay commissions of up to 30% for delivered bookings.
Every digital business can be split into attention revenue and service revenue. Businesses that benefit from transaction volume even at the cost of less time in the app will thrive.
Shinn predicts lower friction increases transaction volume for services like Uber and food delivery, while attention-driven social media is most exposed.
His recommended playbook for incumbents is scaled experiments, such as enabling agent access for 1% of users and measuring satisfaction and transaction volume.
An early product principle was to optimize understandability over capability, meaning users can predict what will happen when they ask for something.
Even the shape of a text message is designed, front-loading the key information because readers scan the first lines in a tapering, flag-like pattern.
New experiences roll out in stages: Shinn first, then the team, then an early access group, then the public, because long-term qualities like trust are hard to capture in evals.
Growth went from 200 friends and family to 1%, then 3 to 4%, then 6 to 9% once users shared use cases online, and now 10 to 11% day over day with $0 spent on marketing.
Each user gets five invites, which has produced status games, embarrassed invite requests, and invites reselling on eBay for around $300.
Shinn spends about 40% of his time on compute. Demand doubles roughly weekly, compute has multi-month lead times, and buying on short notice costs 3 to 4x.
Instinct claims Opus 5 level engagement and eval performance at very low cost by shaping custom inference deployments around latency-tolerant batch work that runs 3x to 8x more efficiently.
Because the agent is natively proactive and wakes and sleeps throughout the day, Shinn expects compute needs orders of magnitude beyond current estimates and beyond coding tools.
On Meta’s Muse, Shinn calls it a great product with a different take and says he spends little time on competitors because most people still are not using AI the way they imagined.
Early versions lacked firewalls and monitors. Rather than patching problems, the team built systems that solve whole classes of issues, including a filter that catches hallucinated proper nouns.
Some users send more than 90% of their messages by voice. Shinn maps his iPhone action button to Instinct and imagines an always-on AirPod interface.
A files feature lets Instinct generate full web applications on the fly for things like trip itineraries or wedding plans, replacing months of traditional software development.
Shinn believes all software collapses into a single, very easy interface without any loss of capability.
The next step is higher level objectives: fitness goals over months, and small businesses running their back office on Instinct with autonomous rules like keeping inventory within a range.
Instinct is not meant to form Her-style relationships. It is meant to be a socially aware operator that adapts its communication style to each person.
The name was chosen to avoid personifying the product with a human name, and to present a competent actor the user respects, not a toy to bully.
Instinct is not tied to iMessage. More than 50% of traffic runs through other channels, and the strategy is to meet users in whatever interfaces they already trust.
The latest round is roughly $1 billion at about a $10 billion valuation, led by Sequoia, Benchmark, and Coatue, and funds the bet against a simple $100 a month subscription.

Detailed Summary

A personal assistant with a phone, a computer, and no app

O’Shaughnessy opens by comparing the current moment in personal agents to the code generation breakout of a year earlier, and possibly bigger. Shinn thinks agents will become the way most people on the planet interact with technology. Instinct is deliberately simple on the surface: it is not a new app or tool but an experience. It has a phone so you can text or call it and it can call you, an email address, and a computer so it can do essentially anything a person does online. Shinn insists that a simple interface should not be confused with limited ability. The whole point is that interacting with AI should need no new application, just the social awareness to work with you the way another person would.

What users are actually doing with it

The use cases are varied because Instinct is not programmed to do any single thing. A well-known example involved a couple who appeared on the US Open jumbotron and had Instinct track down the footage. Shinn describes a community of users who scan every piece of clothing plus their own body so Instinct can plan the week’s outfits as images of them wearing each look, then extend that into shopping across thousands of options with one-message ordering. Others give it goals, like saving a set amount by a certain month, or connect bank accounts so it can find unused subscriptions, cancel them end to end through the merchant’s site and email confirmations, and report the savings. A friend group of six has it plan a new experience every week from their calendars and Spotify tastes, then route one shared Uber to pick everyone up.

The trusted person network and agent to agent coordination

About ten days before the interview, Instinct launched a way for users’ agents to talk to each other. The canonical use case is scheduling: you state the intention to meet someone by the end of the week, and your Instinct negotiates with theirs until something lands on both calendars. Connections are restricted to trusted people and carry configurable access levels, from spouses who share everything to colleagues who see only a work calendar. Shinn describes a graph with weighted edges that creates a new form of network effect, and new social dynamics. If someone with calendar access starts digging for other information, your Instinct tells you, and the trust in that relationship is broken. The system leans on existing social norms as well as technical limits on what is visible.

Rewriting reservations and travel

Shinn believes the internet will be rewritten in the coming years and uses restaurant reservations to show how. An agent can check every restaurant in every city every few seconds, which breaks first come first served. Instinct is working on partnerships to build a reservation system that is better for both sides: diners get tables for birthdays and anniversaries, and restaurants get the special occasions they want rather than regulars filling a table nightly. Travel is already 50% of the more than $1 billion in annual transaction volume. A single voice note saying “I need to be in New York tonight” triggers the whole chain, from location and preferred airline to seat, meal, card, hotel, rides on both ends, and calendar entries. Shinn frames online travel agencies as future collaborators rather than targets, given their data and networks.

Trust, privacy, and the safety architecture

The more data a user shares, the more proactive and useful Instinct can be, which creates a chicken and egg problem. The data shows trust takes several weeks to build, and Shinn is comfortable with that because users should share at their own pace and can always take access back. Three weeks in, about 40% of users have shared a credit card, and users who share even one sensitive credential retain around 80%. On security, he separates the tractable work of storing sensitive data from the new attack surface of an agent with autonomous access to cards, email, and calendars. Incoming content goes through firewalls that intercept malicious instructions, and every action or thought is watched by a separate system that can pause and approve or reject it. Later he adds a hallucination filter, decoupled from the agent’s incentives, that catches things like a proper noun invented by a sampling error before a tool call executes, backed by security teams doing continuous adversarial testing.

Alignment with the user and the take rate business model

O’Shaughnessy asks about alignment in the personal sense: an employee is paid by you, so whose interests does a free agent serve? Shinn says Instinct must never influence users against their own wishes, and he argues this matters more as the agent becomes smarter and more socially skilled than its user. He points at ad-driven platforms like Google, TikTok, Instagram, and Snapchat as the reality he does not want to build. Instinct is designed to follow higher level objectives, such as earning trust and having the user’s back, and doing well-intentioned tasks is one way of serving those objectives. With transaction volume compounding at the same 10% daily rate as users, he sees an Apple Pay style model: free for users, with merchants paying a blanket take rate for distribution. He is not trying to shave basis points off the roughly 2 to 2.5% that payment rails share. He places Instinct somewhere on the curve from Shopify and Stripe through Amazon near 10% to Apple’s 30%, with travel commissions as the bootstrap.

Attention revenue versus service revenue

O’Shaughnessy raises the coming corporate agent war and asks when a service like Uber Eats turns adversarial toward agents. Shinn describes plotting every digital business by how much revenue comes from attention in the app versus the underlying service. The simple view is that a 70% attention business collapses to its 30% service core. His view is that reducing clicks has always increased transaction volume, and an agent that proactively lines up a car before every meeting or offers your usual dinner as your flight lands makes friction effectively zero, so the service slice grows. Businesses that benefit from more transactions, even with less time in the app, are well placed. Those that live almost entirely on attention, often against users’ wishes, are most exposed, and Shinn calls it liberating for users. He favors collaboration over coming in hot, and recommends partners run scaled experiments on a small percentage of users to measure risk before committing.

Designing for understandability and feel

Shinn argues that three years of AI launches boasting about capabilities have fatigued consumers and missed the point. An early principle at Instinct was to focus only on understandability: how well a user can predict what will happen when they ask for something. He credits that for engagement and word of mouth. The care extends to the physical shape of a text message, front-loading information into the first 30% and designing for how people scan text, reading most of the first line and less of each subsequent line. Asked whether this is taste or data, he says both. Soft, long-term qualities like trust after three weeks are hard to evaluate, so new experiences roll out in stages from Shinn himself to the team, then an early access group, then everyone. He sees this focus on feel as a durable differentiator even as competitors match capabilities.

Invite-only growth at 10% a day

The program started with about 200 friends and family. Growth crept from a few people a day to 1% and 2%, then 3% and 4%, and once a few thousand users began sharing use cases online it climbed to 6 to 9% and now 10 to 11% day over day, with $0 spent on marketing. Each user has five invites, so every day roughly 10% of the user base decides to give away one of those scarce invites. The invite model is meant to control growth responsibly, not to signal exclusivity, but it has produced status games, apologetic emails asking for invites, and invites selling on eBay for around $300. The open question is where the curve of an upstart compounding fast meets incumbents who can distribute to billions of people in a day.

Buying compute ahead of exponential demand

Shinn says he spends about 40% of his time worrying about compute. Unlike Instagram or Facebook, where doubling users meant a harder but familiar infrastructure problem, Instinct’s underlying compute must also grow 10% a day, doubling roughly weekly. Buying 2x is consumed in a week, 5x in under three weeks, and 10x in a couple more. Compute has a lead time of several months, and buying on short notice costs 3 to 4x. Even at a slower 5 to 8% daily rate compounding through a three to four month procurement window, the result is around 100 million users, so every purchase is a highly leveraged guess. On cost to serve, Shinn claims Instinct matches Opus 5 level results in A/B tests, engagement, and internal evals at a very low cost. Frontier APIs charge a blanket rate per request, but much of an assistant’s work can finish in minutes or hours, and custom deployment shapes for that batch work are 3x to 8x more efficient. Small gains like 30% here and 5x there compound. His personal goal is to keep the product free for everyone for a lifetime, though he does not commit to it yet.

Why proactive agents need orders of magnitude more compute

Asked how much new compute demand agents like this represent at a billion users, Shinn declines to give a number but says it will be orders of magnitude more than expected. Coding tools largely wait for a human prompt before each loop. Instinct’s architecture lets it wake and sleep at any moment: waking at 6 a.m. to scan everything before you get up at 7, deciding to stay quiet, then waking at 4 p.m. to handle something useful you did not know to ask for, or noticing that you are late for an Uber. Only a small subset of its work is interactive, and he thinks the industry’s compute buildout has only scratched the surface of background, proactive work. On Meta’s Muse, he calls it a great product with a fundamentally different take built around a new app, and says he spends little time on competition because most people in any cafe still are not using AI the way they imagined.

Mistakes, security, and staying proactive

Shinn acknowledges that an early version lacked firewalls, active monitors, and other infrastructure, and that it had mistakes. The team responded by building systems to solve whole classes of problems rather than patching individual ones, and this is part of why they ran an invite program from the start. He calls security and safety the most important problem and ties it to company values. He notes that every new consumer experience of the past 20 to 30 years has faced backlash that confused different with unsafe, and says the answer is sticking to principles: users always in control of their data and proactive systems that get ahead of risks. The platform gets more robust over time as adversarial testing grows more creative and models improve.

Simpler interfaces and higher level objectives

The product may gain an app, but Shinn expects it to trend simpler. Some users send more than 90% of their messages by voice, and he has his iPhone action button mapped to Instinct so he can send an email two hours from now without unlocking the phone. He imagines an ordinary AirPod that recognizes his voice and knows when he is addressing it, triaging contracts, news, and requests during a run. In the short term, a files feature lets Instinct generate full web applications on the fly for itineraries or wedding plans, collapsing the months-long cycle of building, shipping, and revising an app. He believes all of software collapses into one easy interface while capability expands. The frontier after tasks is objectives pursued over time: training goals over months, and small businesses running their back office on Instinct, with rules such as keeping inventory within set bounds handled autonomously.

Personality, the name, channels, and capital

Shinn rules out Her-style relationship building. He wants a socially aware operator that learns the best communication and task execution style for each person, picking up signals like lower response rates to long messages. He chose the name Instinct to avoid personifying the product with a human name and to signal a competent actor deserving mutual respect rather than a toy people bully, so users form their sense of the brand through use. On channel risk from Meta’s WhatsApp and Apple’s iMessage, he says Instinct is not an iMessage app. More than 50% of traffic runs elsewhere, and it will shift to whatever interfaces users trust. O’Shaughnessy notes the latest round of roughly $1 billion at about a $10 billion valuation from Sequoia, Benchmark, and Coatue. Shinn says the business is capital intensive, and that the easy path of charging $100 a month is a local optimum. Venture capital lets Instinct take calculated risks to prove transaction volume across industries and escape it. Asked the traditional closing question about the kindest thing anyone has done for him, he points to the relationships around him and his hope to return the same kindness.

Notable Quotes

“I’m not going to spice it up because it’s really just a personal assistant.”
Noah Shinn, describing Instinct at the start of the interview

“Man, any product that’s dependent on consumer laziness or inertia is toast, huh?”
Patrick O’Shaughnessy, reacting to Instinct cancelling unused subscriptions end to end

“So 40% of the user base 3 weeks in are sharing a credit card.”
Noah Shinn, on time to first credit card as a proxy for trust

“We don’t want Instinct to influence the user’s behavior in a way that is not aligned with what the user wants.”
Noah Shinn, explaining why Instinct will not run on ads

“Let’s not focus on capability. Let’s only focus on understandability.”
Noah Shinn, on the early product principle he credits for engagement and word of mouth

“It’s that the resource has a lead time of several months, right?”
Noah Shinn, on why buying compute for a product doubling every week is so hard

“Now we have something that is almost natively proactive.”
Noah Shinn, on why personal agents will need far more compute than coding tools

“The user should always be in control of their data.”
Noah Shinn, on the principle behind Instinct’s security and permission design

“I think that all of that collapses down in the future.”
Noah Shinn, on decades of single-purpose apps giving way to one simple interface

Watch the full conversation between Noah Shinn and Patrick O’Shaughnessy here.

Tag: AI agent trust

Instinct Founder Noah Shinn on the Personal AI Assistant Growing 10% a Day: Earning Trust, Take Rates Instead of Ads, Buying Compute Months Ahead, the Trusted Person Network, and Why All Software Collapses Into One Interface