AI agent Instinct booked reservations and flagged a phishing scam

By Splitfeed EditorialLast updated Sep 26, 2026, 19:17 UTC

A Wired writer published a hands-on account of testing an AI agent called Instinct, with the report dated September 24, 2026. The writer documented a net financial outcome across the testing period: the agent saved $550 and independently booked restaurant reservations, but also spent $64 on unspecified transactions the writer considered wasteful. During the same period, Instinct flagged what the writer identified as a phishing scam. The developer behind Instinct is not named in the report, and the individual tasks are not tied to specific dates.

The report matters because it puts concrete, if modest, numbers on the question of whether AI agents can deliver measurable value in everyday financial and logistical tasks, while simultaneously raising the security question that has shadowed agentic AI from the start. An agent that can book reservations and scan communications for scams necessarily holds access to personal accounts, inboxes, and payment methods. The writer's phrase "security nightmare" signals that the access required to produce those gains is itself a risk, and that tension sits at the center of the current debate over deploying agents in personal contexts. What remains genuinely in dispute is whether a $550 saving and a caught phishing attempt justify granting an autonomous system that level of access, or whether the $64 in waste and the exposure it implies tip the calculation the other way.

No reactions from the Pro-AI, Anti-AI, or Middle Ground camps have appeared yet. Pro-AI voices would typically treat the $550 saving and the phishing catch as validation that capable agents are arriving, and would argue the security concerns are solvable engineering problems rather than reasons to hold back. Anti-AI voices would likely seize on the "security nightmare" framing, arguing that an agent with broad account access creates an attack surface that offsets any convenience gain, and that the $64 in unauthorized-feeling spending illustrates the loss of user control. Middle-ground observers would probably call for clearer permission structures and audit trails, treating this test as early evidence that agents need tighter sandboxing before mainstream use.

The argument would sharpen considerably if the developer of Instinct publishes its security architecture or if independent researchers examine how the agent handles credential storage and communication access. A broader rollout, or a disclosed breach involving a similar agent, would settle the security side of the debate more decisively than any single writer's positive net balance.