November 6: Singapore has issued consumer guidance on personal AI agents, urging users to limit account access, retain control over important actions and understand how to disconnect an assistant if something goes wrong. The joint advisory was published on November 6 by the Cyber Security Agency of Singapore (CSA), Government Technology Agency (GovTech) and Infocomm Media Development Authority (IMDA).
Key highlights
- The guidance concerns assistants that can act through apps and online accounts, rather than simply answer questions.
- Users should connect only necessary services and avoid exposing sensitive credentials.
- Important actions need stronger oversight than routine information retrieval.
- Account permissions, stored memories and activity records all need attention.
Why an AI agent needs different controls
The advisory explains that personal agents can browse websites, handle messages and undertake tasks through connected services. That usefulness changes the consequences of a mistake. An inaccurate chatbot answer can mislead its reader; an agent with permission to act may also send, share or change something before the user notices.
For readers considering their first agent, a practical starting point is to separate the desired result from the access needed to achieve it. Finding an appointment time does not necessarily require the same permissions as sending invitations to everyone involved. Preparing a shopping comparison and authorising an order are also different decisions. These are illustrative examples of permission choices, not incidents reported by the Singapore agencies.
The five steps in the Singapore guidance
The agencies organise their recommendations around five areas: restricting access, supervising significant actions, understanding data use, resisting malicious manipulation and considering effects on other people. Their underlying advice is to grant narrowly defined permissions rather than assume the assistant deserves the broad trust given to a human colleague.
| Area | Question to ask |
|---|---|
| Access | Does this task require this account or folder? |
| Actions | Can the assistant send, delete or publish without another decision? |
| Data | What is retained after the connection ends? |
| Security | Can outside content influence the assistant? |
| Other people | Does the connected material contain someone else’s private information? |
This table is The Press of Asia’s checklist based on the advisory’s five-part structure. It is not a certification of any product.
Permissions matter more than a reassuring chat response
The advisory recommends starting with limited or read-only access where possible. It also tells users to manage permissions through application settings rather than rely entirely on instructions typed into a conversation. The difference is important: a request about behaviour and an enforced restriction on what a service can access are separate safeguards.
Before an assistant starts, identify its stop control and the place where connected accounts can be removed. Afterwards, compare the completed work with the actual activity record. A message saying a task succeeded is not the same evidence as a sent item, saved document or confirmed booking. If the account settings and the conversational response disagree, investigate the account itself.
What malicious instructions can do
Singapore’s guidance warns that hostile instructions can be hidden in material an agent reads, including websites, messages, invitations and documents. This creates a route by which an outsider may try to redirect work the user legitimately requested.
Separate guidance from the United Kingdom’s National Cyber Security Centre (NCSC), published on August 20, also stresses matching autonomy to risk. It calls for technical boundaries, monitoring and a reliable emergency shutdown, rather than dependence on model safeguards or carefully worded prompts alone. That document is aimed at system designers and operators; the Singapore publication addresses consumers.
For a household or small business, the practical question is not whether an assistant seems confident. It is how much damage an incorrect action could cause and whether that action can be stopped or reviewed before it takes effect. A low-risk trial with non-sensitive material provides a more useful introduction than immediately connecting every account.
Privacy includes information about other people
The joint advisory asks users to examine how information is processed, retained and used, including memory and training settings. Disconnecting a service should not be assumed to erase information already retained elsewhere. Users need to check the relevant provider’s controls and terms.
Shared correspondence creates an additional issue. An inbox can hold information supplied by friends, customers or colleagues who never chose to use the agent. Consider which material is necessary for a task before exposing a whole archive. Where the service offers narrower access, that choice can reduce unnecessary disclosure.
What to watch
The useful test for the next generation of assistants is whether their controls are understandable and verifiable: users should be able to see what is connected, distinguish reading from acting, inspect completed activity and revoke access. The Singapore advisory is safety guidance, not an announcement that AI agents are banned or that any named product is guaranteed secure.
File photo: Old Hill Street Police Station in Singapore, November 17, 2022. Archival location image, not an AI product or a reported security incident. Photo: Cbogsin / Wikimedia Commons, CC BY-SA 4.0; cropped and resized under the same licence.
Sources
- CSA: Joint advisory by CSA, GovTech and IMDA
- CSA, GovTech and IMDA: Using Personal AI Agents Safely and Securely
- NCSC: Managing the cyber risk of agentic AI
The Tech Desk covers technology, artificial intelligence and cybersecurity. Stories are checked against at least two credible sources before publication.
