CowAgent vs Instinct

CowAgent

MIT software with seven releases in 90 days, memory kept as plain files in the owner's workspace and three per-session permission modes. Source and Docker installs default to full-access, no action asks for approval, and an open report of 31 July 2026 says group members could reach the owner's files through the bot.

Instinct

The terms and privacy policy are specific about connected accounts, model training and the risks of autonomous actions, and security.txt is valid. No price, documentation, status page, changelog or programmatic interface is published, and customer content trains AI models unless the owner opts out.

CowAgent

1. Set agent_permission_mode to workspace-write or read-only before connecting any channel. Source and Docker installs default to full-access
2. Keep the bot out of group chats that include other people. Any member who mentions it reaches the same tools as the owner
3. Set web_password before changing web_host to 0.0.0.0. The password is empty by default
4. Set external_api_token to enable POST /v1/chat/completions, and send conversation_id to keep one session. The model field does not select a model
5. Run it in a container for a hard boundary. The docs and the source both say the permission modes are not isolation

Instinct

1. Do not plan on calling Instinct from a program. No API, MCP server or key was found, and the terms forbid automation software and benchmarking
2. A person signs in at app.instinct.com with a phone number and a one-time code by text, and may wait for a place when the service is at capacity
3. Tell the owner to opt out of model training at app.instinct.com/settings before connecting mail or files, since training is on by default
4. Disconnecting an account does not delete what was indexed from it. Delete that data at app.instinct.com/workspace
5. Treat purchases and bookings as final. The terms say actions may not be reversible and that confirmation controls are not guaranteed