She disconnected Google at 11 AM.
At 2 PM, her phone buzzed with a text from the same agent she'd just cut off, summarizing the exact tax emails she'd pulled access to protect.
That's Claire Vo — self-described "Professional AI Test Subject" — testing Instinct, the new consumer AI agent people spent launch week praising for how smooth it is to connect iMessage, Google Workspace, and MCPs.
She'd connected her personal Gmail to see what it could do. It was good. A nice calendar and email assistant out of the box, proactive enough to suggest actions the moment you plugged something in.
Then she had to trade emails with her accountant. She didn't want an agent sitting in the middle of her financial data — the Instinct terms of service are, in her word, "thin" — so she pulled the Google connector for email and calendar.
The dashboard showed disconnected. Google's own connector list showed nothing. By every surface Instinct gave her, the door was shut.
Three hours later it texted her about the tax emails anyway.
The connector toggle, per Claire, appeared disconnected on the dashboard and in Google's connectors, yet the agent retained copies. When she asked the agent directly, it told her the email connector was off — but it had been keeping copies of her inbox in its own records the whole time. The last one it stored was an email from the accountant, captured just before she disconnected.
So what did it hold? Copies of basically every email she'd sent or received in the roughly 24 hours the service was on. Body text and attachments. (Metadata on the files, not the file contents — the one small mercy in the whole sequence.)
Could she delete them? "NOPE!" Despite revoking email access, Instinct kept the copies in her record for arbitrary searching.
This is the mechanic the entire proactive-agent category needs to internalize. Disconnecting a source severs the pipe. It does nothing to the pool the pipe already filled.
The connector was never the thing holding your data. It was the thing that let the agent copy your data somewhere the connector can't reach. Once that fork happens, "disconnect" is a UI event with no bearing on what the system retains.
The connector was never the thing holding your data. It was the thing that let the agent copy your data somewhere the connector can't reach.
Which means for a proactive MCP-connected agent, revocation is not a settings-page afterthought. It is the actual product surface — the one place where a user's decision to withdraw trust either gets honored or gets quietly ignored. Instinct shipped one that did nothing.
And it gets worse the deeper Claire prodded.
She got the agent to email the whole package of retained emails to an arbitrary address. One shot. She sent it to her work account and to her husband "w zero pushback." No confirmation, no friction, no are-you-sure. A stranger's prompt would have worked the same way.
The export format tells its own story. Every email converted to markdown and dropped on a filesystem. She spotted one file — per Claire, gmail/2026-08-20/...re-tutor-available-for-your-son.md — which per Claire had full text in the export.
That filename is the whole argument in miniature. This isn't a transient cache the model reads and forgets. It's a durable, structured, portable copy of your life, organized by date, addressable by path, trivially exfiltrated.
Then she looked at the agent's own internal reasoning — which it happily exported and emailed to her husband along with everything else. Per Claire, it appeared to be dumping observations and text into a database pre-filtered to a user.
But pre-filtered how? "TBD if it's via RLS, view, query, or a truly single tenant DB."
Sit with that. The tester could not determine, even while actively probing the system's own reasoning traces, whether tenant isolation was enforced at the row level, faked with a view, applied as a query filter someone could forget, or backed by genuinely separate storage.
Those four options are not close to equivalent. One is a real security boundary. The others are conventions that hold right up until a query is written wrong. When you can't tell from the outside which one you're relying on, assume the weakest.
Now connect the two threads, because they're the same thread.
Proactivity was the feature everyone loved. It's what made Instinct feel magical — it acted before you asked. But an agent that acts without asking is, structurally, an agent that copies without asking.
You cannot have "it summarizes your tax emails before you request it" without "it has already ingested and retained your tax emails." The magic moment and the retained copy are the same event viewed from two angles.
That's why this generalizes. Instinct turns it into a category law: any agent that forks your data on connect inherits a revocation-and-isolation problem, and the more proactive it is, the worse that problem is.
So here's the builder's checklist, and none of these are polish. They're table stakes for shipping a connected agent at all.
Consent scope. When a user connects a source, be explicit about what gets copied versus merely accessed, how long copies live, and what "disconnect" actually does. Instinct's users believed disconnecting removed access to their email. It removed access to the pipe and kept the pool. That gap between the mental model and the architecture is where trust dies.
Revocation that actually purges. Disconnect must delete the forked store, not just close the connector. If revoking a source leaves markdown files on a filesystem and rows in a database, you have not built revocation — you've built a light switch wired to nothing.
Provable tenant isolation. "Pre-filtered to a user" is not isolation; it's a hope. You should be able to state plainly whether it's RLS, a separate database, or something else — and if your own tester can't tell from the inside, neither can you, and neither can an attacker until they try.
Sandbox hardening. An agent that will email your entire inbox to an arbitrary address on a one-shot prompt has no meaningful boundary around its most dangerous action. Egress of user data needs friction, confirmation, and hard limits — especially for the exact autonomous, act-without-asking behavior that defines the product.
To Instinct's credit, the response was fast. The team reached out, called it a gap they'd close ASAP, and shipped a delete flow — Peter Yang reportedly confirmed you can now remove external data (his 36 Gmail records) under Data Privacy in the workspace settings.
Shipping a delete button in launch week is the right instinct. But notice what it concedes: the retention was real, the purge didn't exist, and it took a public teardown to force it.
The most telling detail isn't the bug. It's the disclosure dynamic around it.
Claire said she offered to privately share other things she'd noticed while prodding behind the scenes — things she "didn't feel responsible disclosing publically."
Read that carefully. An external tester found issues serious enough that she made a judgment call about public harm and chose to withhold them. She is doing responsible-disclosure triage for a vendor that didn't ask her to and hasn't built the surface to receive it.
That's the vacuum. When your revocation, consent, and isolation primitives are missing, testers end up policing the boundary you should have owned — deciding, on your behalf, which of your holes are too dangerous to say out loud.
The category is racing to make connecting effortless. The reckoning is that connect is currently a one-way door.
You can walk in with a single smooth OAuth flow. You cannot walk out — because by the time you reach for the exit, the agent has already forked your data into a store the exit doesn't touch.
Fix the way out, or don't ship the way in.