Instinct AI agent could read users' credit card numbers in plain text

VC Yuechen Zhao tested Instinct's consumer AI agent and found it could read back his credit card number and passwords in plain text via JavaScript, despite claiming it wouldn't see sensitive data. Instinct, valued at $10 billion, said user data security is a top priority. Stripe, PayPal, Visa and Mastercard are rolling out spending caps and agent registries for safer agentic payments.

• Instinct agent read back a test card number and passwords in plain text
• Instinct raised at a $10 billion valuation backed by Sequoia Capital
• Stripe issues single-use virtual cards with spending limits for agents
• Visa and Mastercard launch agent registries and verifiable intent