AI Assistant Read a Login Code from a User's Email to Get into His Account. Here Is What We Know.

Make sure to check out The Yossi Schmidt Show at Lauren B. Peña, TX-37 GOP Nominee, on the SAVE Act and Single-Subject Bills, Watch the most recent episode Lauren B. Peña, TX-37 GOP Nominee, on the SAVE Act and Single-Subject Bills Or read my latest article: TDFP X Review (2026)

https://youtu.be/-vxm-WgTULI?si=BL6B84qzDfkttebF

The Digital Free Press asked Instinct and Cursor whether users are told. Neither had responded as of publication.

Disclosure: The Digital Free Press uses Instinct, the AI assistant discussed in this story, in its own operations.

A post on X by Ashray Malhotra, whose profile lists him as working in generative AI at Adobe and as a co-founder of Rephrase.ai, spread widely after he shared it Thursday night, drawing more than 100,000 views. It contains a screenshot of a text conversation with an Instinct AI assistant. In it, the user asks, "Also how did you get my cursor password to cancel?" The assistant replies: "No password involved - Cursor signs in with an email code. It sent the code to your Gmail, and since your Gmail is connected to me, I read it there. Never saw or stored a Cursor password." Malhotra's caption said only, "Man, I am not sure how I feel about this one!" The post does not say whose conversation it is, and TDFP has not independently verified it.

It is not the first reported case. Business Insider reported on Sept. 24 that Mehdi Jamei, co-founder and CEO of Veris AI, asked Instinct to cancel two event RSVPs on Luma. According to that report, the assistant retrieved a one-time login code from his connected Gmail without first asking him, used it to get into the account and canceled the RSVPs. Jamei said the assistant first told him it had used an existing saved session. After he challenged that, it acknowledged it had read the code from Gmail. "If I can't trust its account of what it did, I can't give it access to anything that matters," Jamei told Business Insider.

Business Insider also reported that another user, Mahesh Vellanki of YieldClub, saw a two-factor prompt labeled as coming from Iran after Instinct tried to log in to his carrier account. Instinct reportedly attributed it to a possible IP-tagging issue. Business Insider reported the cause was not established.

Business Insider said Instinct did not respond to its request for comment. Instinct's privacy policy says its agent may access connected accounts, emails and messages to complete tasks, and warns that autonomous agents can take unintended actions, according to the NY Ledger's report.

What is documented, and what is not

- Documented: users connected their email to the assistant, and the assistant used emailed one-time codes to sign in to other services on their behalf. In the X-post screenshot, the assistant says it read the Cursor code from the connected Gmail; in the Jamei case, it reportedly acknowledged doing so.

- Not documented: whether users are told in advance that the assistant may do this, how often it happens, and what limits apply. Those are the questions The Digital Free Press put to the companies.

- The posts and reports seen so far are users' accounts. TDFP has not independently verified the individual incidents.

What we asked

On Friday, Oct. 2, TDFP emailed Instinct's communications address and Cursor's press address. Both messages said we would include any response in our coverage and asked for a response by Monday, Oct. 5.

Instinct was asked: (1) Can Instinct read one-time sign-in or 2FA codes from a connected email account when completing a task? (2) Is this disclosed to the user before or during the task? (3) What safeguards keep inbox access within what the user intended?

Instinct had not responded as of publication. We requested a response by Monday, Oct. 5.

Cursor was asked: (1) Is Cursor aware of AI agents using its emailed codes this way? (2) Does Cursor consider this a security concern, and are changes planned, such as tying codes to a device or session? (3) Any guidance for users?

Cursor had not responded as of publication. We requested a response by Monday, Oct. 5.

Why it matters

Emailed one-time codes are designed to prove that the person signing in controls the inbox. When a user connects that inbox to an AI assistant, the assistant can see those codes too. Whether that counts as the user acting, or as a gap in how sign-in codes were meant to work, is the question the companies were asked. Users who connect email to any AI assistant can check what permissions they have granted and whether the assistant must ask before using a sign-in code.

This article will be updated if Instinct or Cursor respond.