Singapore authorities urge strict limits on AI agent autonomy, access to personal accounts

SINGAPORE – When using personal artificial intelligence agents, connect only necessary apps, restrict access to sensitive accounts and specify that permission is required before deleting or sharing files.

These are among the precautions set out in an advisory issued on Nov 6 by the Cyber Security Agency of Singapore, the Government Technology Agency and the Infocomm Media Development Authority to help consumers use personal AI agents safely.

Unlike chatbots that primarily answer questions, personal AI agents can take actions on users’ behalf, such as browsing websites, managing e-mails and making bookings.

The advisory follows the launch in Singapore of Meta Muse, which the company bills as the world’s first personal AI agent built for consumers.

The agent can connect to services such as Gmail and Google Calendar to help users manage e-mails and schedules and work with shopping and travel platforms.

But this convenience brings privacy and security risks.

Depending on the level of access, agents may expose sensitive information, make mistakes or act beyond users’ intentions, the advisory said.

Some agents continue working in the background, while malicious websites or messages could trick them into taking harmful actions.

“AI agents can be very useful, but you cannot treat them like human assistants and give them the same broad access to your information and implicit trust,” the advisory said.

“Instead, grant narrowly scoped permissions, retain control of consequential actions and understand how to revoke access,” it added.

“You remain responsible for how you use AI agents, including the actions these agents take on your behalf. Depending on the circumstances and applicable laws, you may also be held liable for these actions.”

The advisory outlined five precautionary steps, starting with limiting what an agent can access.

Users should connect only the necessary apps and accounts and, where possible, restrict access to specific information within them. They can start with less sensitive material, such as a secondary e-mail account, to understand how the agent works.

The advisory recommends avoiding giving agents access to banking, government and healthcare accounts, and checking with employers before connecting work accounts.

It also cautions against sharing credit card details or authentication credentials, including passwords and one-time passwords (OTPs). This extends to documents, e-mails or messages containing such information.

An agent connected to an inbox that receives OTPs may be able to read them. Users could consider using a separate e-mail account to receive authentication messages for sensitive accounts.

The second step is to retain control of important actions, starting with limited or read-only permissions where possible.

Agents should seek permission before taking actions with significant consequences, such as sending messages, deleting or sharing files or posting publicly. Users should choose one-time approval over an “always-allow” option and check details carefully for high-risk transactions.

“Do not rely solely on chat instructions to limit your agent’s actions, as these may not always be followed consistently,” the advisory said.

Instead, users should set permissions through app settings, including those of the services an agent accesses. They should regularly revoke unnecessary permissions and check activity records, as agents may behave inconsistently even when performing similar tasks.

Third, users should understand how their information is used and stored.

Information shared directly or obtained through connected accounts may be processed and stored by the agent provider and its partners. Users should check what is collected, who receives it, how long it is retained and what happens after an account is disconnected.

They should also check whether their information is used to train AI models or personalise advertisements and adjust available settings.

“Many personal AI agents have persistent memory, and they can create personal profiles of you and your contacts based on your files and interactions,” the advisory said.

Users should delete stored information that is inaccurate or that they do not want retained or used.

The fourth step is to guard against scammers and malicious actors, who may target agents through instructions hidden in websites, e-mails, calendar invitations, documents or images.

These could manipulate agents into making purchases, transferring funds or revealing personal data without the user’s request.

“The best protection is to limit what your agent can see or do,” the advisory said.

Users should monitor agents as they browse on their behalf, restrict who can give them instructions, use strong authentication, download agents only from official sources and use only trusted third-party add-ons.

If something goes wrong, they should stop the agent, disconnect affected accounts and look out for changes they did not make, such as payments, changed settings or e-mail forwarding rules. They should save activity records before deleting suspicious memories, add-ons or tasks, and notify anyone affected.

Finally, users should consider others whose information an agent may encounter.

E-mails, messages and files can contain details about family, friends and colleagues. Users should consider whether those people would be comfortable with an agent reading or sharing them, and delete unnecessary memories about others.

They should indicate when an e-mail or message was sent by an AI agent, and not ask it to bypass paywalls, login requirements or other access restrictions.

“Respect other people’s information,” the advisory said. “Avoid sharing sensitive information about others unless you need to.”