Privacy by Editorial Team

AI Agents in Your Text Messages: The New Privacy Surface

A wave of SMS-resident AI agents read your calendar, email, and contacts. TechCrunch's October 2026 survey maps 15 vendors and what their consent flows miss.

If you have not yet received a message from an AI agent that knows your calendar, the rest of this article is your early warning. In a round-up published October 3, 2026 by Lauren Forristal at TechCrunch, at least fifteen vendors now ship AI assistants designed to be reached the same way you reach a person: by SMS, iMessage, WhatsApp, or Telegram. Several have raised venture rounds in the hundreds of millions. One is already inside Apple’s Messages for Business platform. The privacy model is, in most cases, whatever the vendor’s defaults allow, and those defaults are still moving.

What an SMS-resident agent actually reads

The first thing to understand about this category is that the agent is not a chatbot. According to Forristal’s survey, the agents in this class take actions on the user’s behalf, adding calendar events, drafting and posting email, sending messages, paying bills, ordering groceries, and signing up for new services. The input surface is your address book and your message thread. The output surface is your real identity at the carrier, your phone’s push token, and any third-party service the agent is permitted to act on.

A partial list of what these agents request access to, drawn from the same TechCrunch piece: Google Calendar and Outlook calendars, Gmail inboxes, Google Drive files, WhatsApp message history, Instagram DMs, payment cards, and dedicated email addresses that the agent uses to register for services without exposing the user’s real inbox. Caddy reads conversations across iMessage and RCS to extract scheduling context. Fambot reads Gmail and Google Calendar to produce nightly next-day summaries. Folk runs on a private cloud computer and can execute multi-step tasks. Pally bridges WhatsApp, Gmail, calendars, and Google Drive. Instinct has begun giving each user a dedicated email address the assistant can use to register for services.

That is the practical reason an SMS-resident agent is a different privacy object from a chatbot on a webpage. A chatbot is a perimeter. An SMS agent is a participant. It sits inside the most intimate channel on the phone, alongside one-time codes, two-factor prompts, and the people you actually know.

Poke and Apple’s door

The category got its first platform-level stamp of approval in June 2026, when Apple let Poke onto its Messages for Business platform. Until that approval, Messages for Business was restricted to airlines, retailers, hotels, and other large companies communicating with their own customers; third-party AI agents were not eligible. Poke, built by the Interaction Company of California, is the first standalone AI agent to clear Apple’s review for that surface.

In the same June 4, 2026 TechCrunch report by Sarah Perez, Poke co-founder Marvin von Hagen described the approval as evidence that Apple sees messaging as the right surface for AI agents. The company had to verify it could offer live support, clearly disclose that the conversation partner is automated, customize its UI to Apple’s style guide, and submit testimony from its messaging providers. The Interaction Company of California was reported as a 10-person team at the time, backed by Spark Capital and General Catalyst.

The significance is what Apple’s platform now permits. A user who has Poke or a comparable agent running on their phone can be contacted by a business inside iMessage without ever downloading a separate app, and the same agent that handles the inbound message also has read access to outbound conversations in the user’s thread. That is a permission surface Apple previously kept narrow.

Instinct, money, and a privacy policy reset

If Poke is the platform story, Instinct is the money story, and the cautionary one. The October 3 round-up noted that Instinct’s level of autonomy had drawn privacy and security criticism. The same company raised $1 billion in a Series C at a $10 billion valuation on September 28, 2026, per TechCrunch’s reporting, just 33 days after closing $350 million at a $2.5 billion valuation in late August. The round was led by Sequoia Capital, Benchmark, and Coatue. Instinct had been running as an invite-only service since August 2026, operating through its own phone number and computer, with features that include calling businesses, paying bills, and a “trusted person network” that lets agents coordinate with friends’ agents.

The privacy flag, again from Forristal’s October round-up and the September 28 funding story, is that Instinct’s initial privacy policy was criticized for overreach, and has since been revised. The combination - a $10 billion valuation, an agent that can call businesses and pay bills on your behalf, and a privacy policy that was publicly walked back before the funding round closed - is the clearest data point in this category so far on the gap between what an SMS agent can do and what its users have consented to.

What This Means

The privacy question for an SMS agent is not the same as the privacy question for a chatbot, and the difference is consent surface. A chatbot is a thing you visit. An SMS agent is a thing you give your phone number to. Once the agent is in your thread, the carrier’s metadata about who you message, when, and how often belongs to the conversation, and the agent’s vendor can read it. If the vendor is also granted access to Gmail, calendar, contacts, or a payment card, the consent surface expands by an order of magnitude, and most onboarding flows do not slow down to ask the user to read the new permissions line by line.

Three concrete implications follow. First, the fact that Instinct had to revise its privacy policy before its reporting round is the closest thing this category has to a consent precedent. Future SMS agents will be expected to ship with policy copy that does not require revision. Second, Apple’s Messages for Business approval sets a quality bar: live support, explicit AI labeling, style-guide compliance. Any agent that wants the iMessage address book will have to clear a similar gate. Third, the operators of these agents hold a security surface that did not exist when the only AI in your phone was a keyboard autocomplete: the agent now holds tokens for email, calendar, drive, and payments. A compromise of the vendor is a compromise of your inbox.

The practical action for a reader is the same as it has been for every consumer AI product since 2024: read the onboarding, count the permissions, assume anything you give the agent will eventually be read by a human during an incident review, and turn off anything you would not want a stranger to see. The action for the industry is harder. It requires deciding whether the consent defaults in this new surface deserve a $10 billion valuation, or whether they need to be rewritten first.

The Bottom Line

At least fifteen SMS- and messaging-resident AI agents are now shipping in the US, one of them is the first third-party AI on a major platform’s business channel, and the category’s highest-funded entrant had to revise its privacy policy before its funding round closed. The agent in your text messages is the new perimeter. The perimeter is still being defined.