Singapore warns users to limit what personal AI agents can access

What Singapore's agencies said

Singapore's Cyber Security Agency (CSA) teamed up with GovTech and IMDA to publish a joint advisory on Friday (Nov 6), as CNA reported. Its message to consumers: personal AI agents can save time, but they bring new privacy and security risks.

The advisory names Dots, Hermes, Muse, Grok Bot and OpenClaw as examples of such agents. Its core point is that you should not treat an agent like a human assistant and hand over the same broad access and trust.

Why an agent is not just a chatbot

A chatbot answers questions. An AI agent goes further and takes actions for you. According to the advisory, agents can link into your apps and accounts, browse the web, deal with your email and make bookings. Many also remember your preferences and what you have told them.

That access is what makes them useful, and also what makes them risky. Depending on the permissions you grant, an agent may read and reveal sensitive information, make mistakes, or do something you never intended. Some keep working in the background even when you are not using them, so a problem may not be obvious right away.

How scammers can target the agent

The advisory's warning is blunt: "Scammers may target your AI agent instead of you," it says. A website, email or message can contain hidden instructions. If the agent reads them and obeys, it might make purchases, move money or give out personal details without your approval.

Because some agents run quietly in the background, you may not notice anything wrong at first. The advisory says the best protection is to limit what your agent can see or do.

Practical tips include not leaving agents logged in to important accounts while they browse, and stopping them if they head to a site you did not intend. Users should also restrict who can give the agent instructions, protect their accounts with strong authentication, and download agents only from official sources.

The five steps, in plain terms

The advisory lays out five steps. The ones the article spells out most clearly are limiting access, keeping control of important actions, and understanding how your information is used and stored.

• Connect only what is needed. Email, calendar, contacts, messages and files can all be requested. Link only the accounts the task requires, and narrow what the agent can see inside each one.
• Keep sensitive accounts out. Avoid giving agents banking, government or healthcare access, and do not share credit card details.
• Never share credentials. That covers usernames, passwords, passcodes and one-time passwords (codes sent to confirm it is you). For Singpass, the advice is to use passkeys, finish the sign-in yourself and reject authentication requests you did not expect.
• Stay in charge of big actions. Start with limited or read-only permissions, and require the agent to ask before sending messages, deleting files or posting publicly.
• Know where your data goes. Providers and partner companies may process and store what you share. Check what is collected, who gets it, how long it is kept, and whether it trains AI models or personalises ads.

Settings beat chat instructions

One useful detail: the authorities suggest managing permissions in an app's settings rather than only telling the agent what to do in chat. Chat instructions may not be followed consistently, while a setting is a harder limit.

They also recommend regular check-ups. Review the permissions and credentials you have given, revoke what is unused, and look at what your agent has been doing. Many agents keep a persistent memory and may build profiles of you and your contacts, so look through that and delete anything wrong or unwanted.

Responsibility and other people

The advisory also says consumers stay responsible for how they use agents. Depending on the circumstances and the applicable laws, you could be legally accountable for what an agent does in your name.

It asks users to think about others too. Your emails, messages and files may hold information about family, friends and colleagues, so avoid sharing it unnecessarily. Say so when a message was sent by an agent, and do not use agents to get around access restrictions on websites or digital services.

If something goes wrong, stop the current task, disconnect the affected accounts and look for changes you did not make. Remove unfamiliar add-ons, saved logins and tasks, revoke exposed credentials, and report suspicious behaviour where needed. Save activity records before deleting anything, and tell anyone who may be affected.