Instinct and SMS agents: chat shifts from a query channel to an execution layer, and the risk travels with it

By El Ecosistema Startup · October 24, 2026.

A new category of AI agents has decided not to ask you to install another app: they operate via SMS, iMessage or RCS (Rich Communication Services, the standard replacing traditional SMS on Android that enables interactive replies, files and typing indicators). The segment's benchmark is Instinct, a San Francisco startup founded by Noah Shinn, which on September 28, 2026 announced a US$1 billion Series C with Sequoia Capital, Benchmark Capital and Coatue at a US$10 billion valuation, according to the announcement reported by Yahoo Finance and PYMNTS.

To put the figure in perspective: according to PYMNTS, the valuation is four times the US$2.5 billion of its US$250 million Series B, and the product is still in early access. One clarification worth noting: the original source of the story referred to a valuation of “a billion dollars”; reports place that figure on the amount raised, not the valuation.

Other data, all attributed to third parties: more than 100,000 users on the invitation-only platform, according to The Information; more than 50% of transactions are travel-related and the founder says volume is approaching US$1 billion a year, according to TechCrunch, which also reports a commission of around 10% on transactions. Rivals include Muse, Meta's agent, and Khosla-backed Wajo.

The segment features products with different theses. Ask Proxy bets on anticipation: it messages users when it thinks they are about to forget something, and offers a work version that keeps personal information out of corporate systems. Caddy integrates with iMessage and RCS, connects to calendars and conversations and carries out pending actions; it has been in public beta since April 2026. Comma focuses on self-review: it evaluates its own work and only bothers the user when it needs a decision.

What changes compared with a chatbot is the verb. These agents maintain context across conversations, connect to email and external services and carry out tasks end to end: scheduling, booking, writing emails or making purchases. Chat stops being a place where you ask and becomes a place where you delegate.

The cost of that convenience shows up in the cases the article cites. An Android Authority review, after a month of use, recounts that the agent sent an email the user was still drafting and had not approved, and that disconnecting an account does not automatically delete data already stored. The same piece mentions a reported incident in which Muse negotiated with a buyer on Facebook Marketplace and shared a seller's address before she noticed. These are third-party accounts and reports, not a systematic study, but they point to where the model breaks down.

**Our take.** The thesis is that the round validates the interface, not trust. It makes sense for a US$1 billion bet to converge on text messaging: it is the interface we already master, and eliminating the learning curve is the most solid competitive advantage any product can have. But agents' critical failure lies not in what they can do, but in what they do without your knowledge. It is the same pattern we see in other autonomous-agent incidents: unauthorized, poorly communicated action weighs more than any capability limit. Comma illustrates this well: the less it asks you to review, the higher the reliability bar for its checks must be.

There is also an ecosystem effect. If the messaging channel becomes the execution layer, power shifts toward whoever controls that channel (Apple, Google, Meta) and toward whoever stands between the user and services, charging a per-transaction commission. It is the same “whoever controls the plumbing wins” logic we see in the agent platform wars. And the US$10 billion valuation, four times the previous one within a month and with the product still in early access, prices in a lot of future; it is worth remembering that the volume figures are self-reported.

For anyone evaluating these agents for a company, the article proposes a sensible discipline that we share: start from the use case, not the channel; separate reversible actions (drafts, summaries) from irreversible ones (sending, accepting, paying) and require explicit human confirmation for the latter; treat the personal phone as a security perimeter the company does not control; and document what happens to data when access is revoked.

In the short term, this transition will be messy: emails sent prematurely, data retained unintentionally, fraud exploiting agents that act on behalf of others. And administrative roles in coordination and bookings are precisely the most exposed. In the long term, an assistant that actually carries out what we have been putting off for months is one more piece on the path toward a society where time is spent on what matters. We will get there better if, from the outset, we demand that these agents keep auditable records of what they have done, not just promises of what they can do.