Singapore authorities urge strict limits on AI agent autonomy, access to personal accounts

SINGAPORE – When managing personal artificial intelligence agents, connect only the necessary apps, restrict access to sensitive accounts, and specify that permission is needed before deleting or sharing any files.

These are among the precautions set out in an advisory issued on Nov 6 by the Cyber Security Agency of Singapore (CSA), Government Technology Agency (GovTech) and Infocomm Media Development Authority (IMDA) to help consumers use personal AI agents safely.

Unlike chatbots that primarily answer questions, personal AI agents can take actions on users’ behalf, such as browsing websites, managing emails and making bookings.

The advisory follows the Singapore launch of Meta’s Muse, which the company bills as the world’s first personal AI agent built for consumers. It can connect to services such as Gmail and Google Calendar to help users manage emails and schedules, and work with shopping and travel platforms.

But such convenience brings privacy and security risks. Depending on their access, agents may expose sensitive information, make mistakes or act beyond users’ intentions, the advisory said. Some continue working in the background, while malicious websites or messages could trick them into harmful actions.

“AI agents can be very useful, but you cannot treat them like human assistants and give them the same broad access to your information and implicit trust,” the advisory said.

“Instead, grant narrowly scoped permissions, retain control of consequential actions and understand how to revoke access.”

The advisory added: “You remain responsible for how you use AI agents, including the actions these agents take on your behalf. Depending on the circumstances and applicable laws, you may also be held liable for these actions.”

The advisory outlined five precautionary steps, starting with limiting what an agent can access.

Users should connect only necessary apps and accounts and, where possible, restrict access to specific information within them. They can start with less sensitive material, such as a secondary email account, to understand how the agent works.

The advisory recommends avoiding access to banking, government and healthcare accounts, and checking with employers before connecting work accounts.

It also cautions against sharing credit card details or authentication credentials, including passwords and one-time passwords (OTPs). This extends to documents, emails or messages containing such information.

An agent connected to an inbox that receives OTPs may be able to read them. Users could consider a separate email account for sensitive accounts’ authentication messages.

The second step is retaining control of important actions, starting with limited or read-only permissions where possible.

Agents should seek permission before actions with significant consequences, such as sending messages, deleting or sharing files, or posting publicly. Users should choose one-time approval over an “always-allow” option and check details carefully for high-risk transactions.

“Do not rely solely on chat instructions to limit your agent’s actions, as these may not always be followed consistently,” the advisory said.

Instead, users should set permissions through app settings, including those of the services an agent accesses. They should regularly revoke unnecessary permissions and check activity records, because agents may behave inconsistently even when performing similar tasks.

Third, users should understand how their information is used and stored.

Information shared directly or obtained through connected accounts may be processed and stored by the agent provider and its partners. Users should check what is collected, who receives it, how long it is retained and what happens after an account is disconnected.

They should also check whether their information is used to train AI models or personalise advertisements, and adjust available settings.

“Many personal AI agents have persistent memory, and they can create personal profiles of you and your contacts based on your files and interactions,” the advisory said.

Users should delete stored information that is inaccurate or that they do not want retained or used.

The fourth step is guarding against scammers and malicious actors, who may target the agent through instructions hidden in websites, emails, calendar invitations, documents or images.

These could manipulate it into making purchases, transferring funds or revealing personal data without the user’s request.

“The best protection is to limit what your agent can see or do,” the advisory said.

Users should watch agents browsing on their behalf, restrict who can give them instructions, use strong authentication, and download agents only from official sources and use only trusted third-party add-ons.

If something goes wrong, they should stop the agent, disconnect affected accounts and look out for changes they did not make: like payments, changed settings or email forwarding rules. They should save activity records before deleting suspicious memories, add-ons or tasks, and notify anyone affected.

Finally, users should consider others whose information an agent may encounter.

Emails, messages and files can contain details about family, friends and colleagues. Users should consider whether those people would be comfortable with an agent reading or sharing them, and delete unnecessary memories about others.

They should indicate when an email or message was sent by an AI agent, and should not ask it to bypass paywalls, login requirements or other access restrictions.

“Respect other people’s information,” the advisory said. “Avoid sharing sensitive information about others unless you need to.”