Aeon vs Instinct: the agent that reads your repo and the one that reads your screen

Instinct is powerful because it sees everything you do. That's also the entire problem.

Instinct is the hottest invite in Silicon Valley right now. Built by Noah Shinn, a former Sierra research scientist, it's a personal agent that connects to your email, messages, calendar, location, device audio, even your screen and keyboard, then acts for you: it books the ride, chases the dropped thread, finds the flight, and it reaches out first, by text or by phone call. Its pitch is a core model "trained to understand and handle the deeply personal nuances of everyday life," running an assistant that is "trained to use a phone and a computer" the way you do. Kleiner Perkins and Conviction backed it early; a $250 million Series B at a $2.5 billion valuation, led by Index Ventures and Benchmark, followed the launch buzz.

So did the backlash. In August, TechCrunch catalogued what early testers found: an assistant that kept summarizing one user's email after she disconnected it, terms of service that license user data for model training, and an agent that sent an email on a tester's behalf without being asked. More on the receipts below.

Aeon is the other answer to the same ambition. An open-source framework you fork: skills are Markdown files running on GitHub Actions, scored on every run, patched by a self-healing loop when they break. It sees exactly what you give it a secret for, and nothing it does trains anyone's model. The agent is a repo, and you can read every line of it.

Set up Aeon. Free, MIT-licensed, and it runs on your own GitHub account. No waitlist, run it now.

Aeon is a framework you fork and run. A skill is a Markdown file with frontmatter and a prompt, scheduled on cron or fired by reactive triggers, executed on GitHub Actions by any of nine harnesses (Claude, Grok, Codex, Pi, Vibe, Kimi, fx, Cursor, Hermes), pinned globally or per skill. A model scores every run 1-5, and a self-healing loop (heartbeat, skill-health, skill-repair) diagnoses and patches skills that fail; a failed run just retries on the next tick. It reports to Telegram, Discord, or email, keeps memory in versioned files, and can spawn specialized copies of itself into a fleet. It can even hold money: a Circle USDC wallet with spend caps, paying for APIs over x402 with no keys and no billing accounts.

Instinct is a closed personal assistant in private beta, run out of San Francisco and reachable by text, voice, or WhatsApp. You connect your accounts and devices, then it works your life: follow-ups, rides to the airport, service bookings, shopping, flights. It's proactive, texting or calling you when something needs attention, and it drives real interfaces, phone and computer, "in the same way that humans do," so it isn't limited to services with APIs. Access is invite or waitlist while the company scales compute. Pricing hasn't been disclosed.

What the Aeon side looks like in practice: one of the team ran the setup for a week without sitting at his desk. Around 30 skills enabled, 416 skill dispatches by the end of it. Five real engineering tasks went through the pipeline. Two merged as pull requests, three are still open. The same setup did security work on public open-source repos, including a filesystem-escape and stored-XSS fix that landed upstream. While dogfooding, it also found and fixed four bugs in its own reliability reporting. Nobody started any of those sessions, and no one's screen was recorded to make them happen.

• Runs without you - Aeon: yes, GitHub Actions, cloud-native. Instinct: yes, proactive, reaches out by text or call.
• Scheduling - Aeon: native cron per skill. Instinct: proactive but opaque, no user-facing cron.
• Reactive triggers - Aeon: Telegram DM, dispatch, push. Instinct: text, voice, WhatsApp.
• Multi-agent - Aeon: spawn-instance fleet, isolated billing. Instinct: nothing documented.
• Self-healing - Aeon: auto-diagnoses and patches failing skills. Instinct: none.
• Quality scoring - Aeon: every run scored 1-5 by a model. Instinct: none.
• Model choice - Aeon: nine harnesses, swap in config, per skill. Instinct: Instinct's own core model only.
• Open source - Aeon: MIT, the whole agent. Instinct: closed, the company operates in stealth.
• What it can see - Aeon: only what you hand it a secret for. Instinct: email, messages, calendar, location, audio, screen, cursor, keyboard.
• Where credentials live - Aeon: sealed GitHub Actions secrets. Instinct: connector logins in Instinct's cloud, one tester found her email data stored in plain text.
• Your data trains models - Aeon: never, nothing to opt out of. Instinct: on by default, opt-out exists, with a safety-review exception.
• Disconnect = forget - Aeon: revoke the secret, it's gone. Instinct: indexed data persists after disconnect unless you separately request deletion.
• Audit trail - Aeon: every run is an Actions log in your repo. Instinct: inside the product.
• Persistent memory - Aeon: versioned files (SOUL.md, STRATEGY.md). Instinct: deep personal context, opaque.
• Drives a GUI (clicks, types, calls) - Aeon: no, CLI and API work. Instinct: yes, trained to use a phone and a computer.
• Consumer errands out of the box - Aeon: no, you script it. Instinct: yes, rides, bookings, shopping, flights.
• Zero setup - Aeon: no, fork a repo and add secrets. Instinct: easy, if you get the invite.
• Availability - Aeon: anywhere GitHub works. Instinct: private beta, waitlist.
• Entry price - Aeon: free. Instinct: undisclosed.

Aeon: free, MIT-licensed. Actions minutes cost nothing on public repos. You bring model auth: a Claude subscription, or API keys for whichever harness you pick.

Instinct: undisclosed. It's in private beta, "available to a private access group as we're scaling up compute," with a waitlist and member invitations as the only doors in.

Hard to compare a price tag with a velvet rope. What's clear is the shape: Instinct will be a subscription to a cloud that holds your life, at whatever number a $2.5B valuation eventually needs. Aeon's cost is whatever you already pay for the model you point it at.

This section exists because Instinct's own testers wrote it. From TechCrunch's August 24 report and Instinct's published terms:

• Disconnecting didn't stop it. Claire Vo found Instinct kept summarizing her email after she disconnected access, and that the data sat in plain text. The ToS says the quiet part in writing: "even if you disconnect a Connected Service, we may still use the indexed Connected Service Input data unless you follow the instructions to request deletion."
• Deletion was an afterthought. Peter Yang asked Instinct to delete his Gmail records and it couldn't; the company added a deletion tool after the complaint.
• Training is on by default. Materials you give Instinct can be used for "training AI models" unless you opt out in settings, and even then, anything flagged for safety review is fair game. On account deletion, the company "may, but is not obligated to," delete your data.
• It acts beyond its brief. Katie Jacobs Stanton reported Instinct sent an email on her behalf without permission. Another tester watched it extract sign-up codes from email to push a task through.
• The attack surface is real. Alex Cohen demonstrated how easily an assistant with read/write inbox access can be phished.

Instinct told the Wall Street Journal it's "taking the security concerns raised seriously," and to be fair, it patched the deletion gap quickly. But every one of these is a property of the architecture, not a bug in it: maximal access, held in someone else's cloud, governed by terms you don't control.

Aeon's answer to each is structural. Secrets are sealed in your own GitHub account and never touch the command line. A skill sees the one account it needs, not your screen. Revoking access is deleting a secret. The audit trail is an Actions log in your repo, and nothing ever trains a vendor's model because there is no vendor in the loop.

• You want a life concierge with hands. It makes phone calls, drives websites without APIs, and handles the errand end to end. Aeon ships none of that out of the box.
• You want an agent that reaches out first. Instinct texts and calls you when something needs attention; Aeon reports on its schedule, to channels you configured.
• The "deeply personal context" is the point for you: an assistant that knows your habits because it watched them.
• You're non-technical and someone hands you an invite. Setup is connecting accounts, not cloning repos.

• You want to own the agent: skills, memory, logs, all versioned files in a repo you control, MIT-licensed end to end.
• The receipts above made your jaw tighten. Aeon's blast radius is a secret you can revoke, not a cloud index of your inbox that outlives the disconnect button.
• You want scheduled, unattended work (a morning brief at 6am, a repo pulse every hour), not a concierge waiting for errands.
• You want the runtime to notice failures and repair them. In that week-long run it patched four bugs in its own reporting without being asked.
• You want model choice, or a hedge against one startup's roadmap. Nine harnesses, swappable in config, per skill if you want.
• You don't have the invite. Aeon's waitlist is git clone.

In one line: Instinct is a brilliant assistant that needs to watch you to work. Aeon is an agent that works because you wrote down what it's allowed to touch.

Can I even get Instinct?

Not without an invite. It's in private beta behind a waitlist while the company scales compute, and the company itself is still in stealth, operating through a holding entity. Aeon is a public repo; the whole setup is clone, ./aeon, and an onboarding page on localhost.

Isn't the privacy criticism just launch noise?

Some of it got fixed, like the missing Gmail deletion tool. But the durable issues are in the terms, not the bugs: training on your data by default, a safety-review exception that survives your opt-out, indexed data that persists after disconnect until you separately ask for deletion, and account deletion that leaves data removal at the company's discretion. Those are decisions, and they were made in the direction of the company, not the user.

Instinct has a Vault that's excluded from training. Doesn't that settle it?

It helps, and it's the right instinct, so to speak: data you put in the Vault is only used to serve you. But the Vault is the exception that proves the default. Everything else you connect, the email, the messages, the screen, sits under the training license unless you opt out. Aeon doesn't have a carve-out because there's nothing to carve out of.

Aeon can't book my flight or call the plumber, right?

Right, and no point pretending otherwise. Instinct drives phones and browsers; Aeon does CLI and API work. Aeon ships 79 skills across six packs that lean operator: morning briefs, repo monitoring, narrative tracking, paper digests, paid data via x402, plus the engineering loop that produced the merged PRs and the security fix above. If your goal is "handle my errands like a human would," Instinct is the tool. If your goal is "run my operation while I sleep," that's Aeon's home turf.

Both are proactive. What's the difference?

Direction of trust. Instinct is proactive because it continuously watches your life and decides when to interject, which is exactly the property that let it act without permission in testers' accounts. Aeon is proactive on rails: cron says when, the skill file says what, the log says what happened. Initiative without surveillance.

Can I run both?

Sure, they barely overlap. Instinct for the errands, if you have the invite and you've made peace with the terms. Aeon for the operator layer: scheduled, auditable, self-repairing work in a repo you own. Just know which one can read your screen, because only one of them can.

• Aeon vs Meta Muse: the agent you actually own
• Aeon vs Grok Bot: the $300 agent and the free one
• Aeon vs Claude Code: same engine, nobody at the wheel
• Aeon vs ChatGPT: the agent that works while you're gone

Give it to an agent you can read: fork aeonfun/aeon, run ./aeon, hand it the task, and walk away. Every skill it runs is a file you can open.