Singapore’s Cyber Security Agency, Government Technology Agency and Infocomm Media Development Authority issued a consumer advisory on 6 November urging people to limit the accounts and information accessible to personal AI agents, The Straits Times reported. The advisory says users are responsible for what agents do for them and could face liability under applicable laws, depending on the circumstances.
Key points
- The agencies recommend keeping personal AI agents out of banking, government and healthcare accounts.
- Users are advised to require approval before consequential actions and to favour one-time permission over standing approval.
- The five precautions also cover data storage, malicious instructions and the regular review of permissions.
Muse and the accounts agents can reach
Personal AI agents differ from chatbots that mainly answer questions: they can browse websites, handle emails and make bookings for a user. Examples of personal AI agents include Dots, Hermes, Muse, Grok Bot and OpenClaw, CNA reported. Some agents can continue working when the user is not actively using them.
The warning follows Meta’s launch of Muse in Singapore with shopping and travel links. Muse can connect to Gmail and Google Calendar to help manage messages and schedules, as well as work with shopping and travel services. Meta bills it as the world’s first personal AI agent built for consumers, according to The Straits Times.
Muse went live in Singapore on 28 October with links to services including Singapore Airlines, Shopee, Grab and Lazada, Techgoondu reported. Meta says the credentials and data for connected services are stored on a dedicated cloud computer, with passwords and payment methods kept out of the agent’s view. The company also says Muse seeks a user’s approval before sensitive actions such as sending an email or making a purchase.
The agencies’ warning concerns the access a user grants, regardless of the task the agent is asked to perform. An agent connected to an inbox may be able to read one-time passwords delivered there. Connected accounts may also contain information about other people. The advisory recommends starting with less sensitive material, such as a secondary email account, while learning how an agent works.
One-time approval for consequential actions
The advisory sets out five precautions, including limiting access, retaining control over consequential actions, examining how information is handled and guarding against malicious actors. They advise connecting only the apps an agent needs and restricting the information available within those apps where possible. Users should avoid giving agents access to banking, government and healthcare accounts, and check with employers before connecting work accounts.
The advisory also cautions against giving agents credit card details or authentication credentials, including passwords and one-time passwords. That precaution extends to files and messages containing those details. For actions with significant consequences, the agencies recommend beginning with limited or read-only access where possible and requiring permission before an agent sends messages, deletes or shares files, or posts publicly.
Users should choose one-time approval rather than an “always-allow” setting and check the details before approving high-risk transactions. The agencies advise setting restrictions through app permissions rather than relying solely on instructions typed to an agent, which may not be followed consistently. They also recommend checking activity records and withdrawing permissions that are no longer needed.
The advisory’s warning about responsibility applies to those choices. “You remain responsible for how you use AI agents, including the actions these agents take on your behalf,” it says. Whether a user may also be held liable depends on the circumstances and applicable laws, the agencies caution.
Stored data and malicious instructions
Information supplied to an agent, including material drawn from connected accounts, may be processed and stored by its provider and other companies it works with. The agencies advise users to check what is collected, who receives it, how long it is kept and what happens after an account is disconnected. They also recommend checking whether chat histories or connected-account data are used to train models or personalise advertisements, then adjusting the available settings.
Some personal agents have persistent memory and can build profiles of users and their contacts from files and interactions. The agencies advise reviewing that stored information and deleting material that is inaccurate or that users do not want retained or used.
Malicious instructions can be hidden in websites, emails, calendar invitations, documents or images an agent encounters. The agencies warn that such instructions could induce an agent to make purchases, transfer funds or disclose personal information without the user asking it to do so. Singapore also formed a cyber task force and launched an agentic AI testing kit, as AI Affairs previously reported.
For services that use Singpass, the agencies advise consumers to select passkey authentication by default, complete the authentication themselves and avoid approving unexpected requests. For other digital services, they recommend authentication methods that require the user to take an action.
