Singapore Urges Tight Limits on Personal AI Agents as Access to Accounts Grows

On Nov 6, three Singapore government bodies put out a joint advisory with a plain message for anyone handing tasks to a personal AI agent: connect only the apps it needs, keep it away from sensitive accounts, and make it ask before it deletes or shares a file. The Cyber Security Agency of Singapore, the Government Technology Agency and the Infocomm Media Development Authority issued it together to help consumers use these tools safely.

The distinction the advisory draws is between agents and chatbots. A chatbot mostly answers questions. A personal AI agent acts for the user: it can browse websites, manage email and make bookings.

The timing follows the Singapore launch of Meta's Muse, which the company describes as the world's first personal AI agent built for consumers. Muse can connect to services such as Gmail and Google Calendar to help people manage email and schedules, and can work with shopping and travel platforms.

The agencies say that convenience carries risk. Depending on what an agent can reach, it may expose sensitive information, make mistakes or act beyond what the user intended. Some agents keep working in the background, and malicious websites or messages could trick them into harmful actions. The advisory states that people cannot treat an agent like a human assistant and give it the same broad access and implicit trust. It urges narrowly scoped permissions, control over consequential actions, and knowing how to revoke access.

It also addresses responsibility. Users remain responsible for how they use agents, including what the agents do for them, and depending on circumstances and applicable laws may be held liable for those actions.

The guidance runs to five steps. The first is limiting access: connect only necessary apps and accounts, restrict access to specific information where possible, and perhaps start with something low-stakes, such as a secondary email account. Banking, government and healthcare accounts should be avoided, and users should check with employers before linking work accounts. Credit card details and authentication credentials, including passwords and one-time passwords, should not be shared, nor should documents or messages containing them. An agent connected to an inbox that receives OTPs may be able to read them, so the advisory suggests a separate email account for authentication messages.

The second step is keeping control of important actions, starting with limited or read-only permissions. Agents should seek approval before sending messages, deleting or sharing files, or posting publicly. Users should choose one-time approval over an "always-allow" setting and check high-risk transactions carefully. The advisory warns against relying only on chat instructions to restrict an agent, since they may not be followed consistently. Permissions belong in app settings, including those of the services the agent uses, and users should regularly revoke unneeded ones and review activity records, because agents may behave inconsistently even on similar tasks.

The third step concerns data. Information shared directly or pulled from connected accounts may be processed and stored by the provider and its partners. Users should check what is collected, who receives it, how long it is kept and what happens after an account is disconnected, and whether it is used to train AI models or personalise ads. Many agents have persistent memory and can build profiles of users and their contacts, so inaccurate or unwanted stored information should be deleted.

The fourth step is guarding against scammers, who may hide instructions in websites, emails, calendar invitations, documents or images to push an agent into purchases, fund transfers or disclosing personal data. The advisory says the best protection is limiting what the agent can see or do. Users should watch agents that browse for them, restrict who can instruct them, use strong authentication, and download agents only from official sources with trusted add-ons. If something goes wrong, they should stop the agent, disconnect affected accounts and look for unauthorised payments, changed settings or email forwarding rules. Activity records should be saved before suspicious memories, add-ons or tasks are deleted, and anyone affected should be told.

The last step is consideration for others. Emails and files hold details about family, friends and colleagues, and users should ask whether those people would be comfortable with an agent reading or sharing them. Messages sent by an agent should be labelled as such, and agents should not be asked to bypass paywalls or login requirements. As consumer agents spread, the advisory's central point is that liability stays with the user.