Singapore warns of privacy dangers as personal AI agents like Meta’s Muse gain consumer access

Users should connect only the necessary apps and accounts and, where possible, restrict access to specific information within them. They can start with less sensitive material, such as a secondary e-mail account, to understand how the agent works.

The advisory recommends avoiding giving agents access to banking, government and healthcare accounts, and checking with employers before connecting work accounts.

It also cautions against sharing credit card details or authentication credentials, including passwords and one-time passwords (OTPs). This extends to documents, e-mails or messages containing such information.

An agent connected to an inbox that receives OTPs may be able to read them. Users could consider using a separate e-mail account to receive authentication messages for sensitive accounts.

The second step is to retain control of important actions, starting with limited or read-only permissions where possible.

Agents should seek permission before taking actions with significant consequences, such as sending messages, deleting or sharing files or posting publicly. Users should choose one-time approval over an “always-allow” option and check details carefully for high-risk transactions.

“Do not rely solely on chat instructions to limit your agent’s actions, as these may not always be followed consistently,” the advisory said.

Instead, users should set permissions through app settings, including those of the services an agent accesses. They should regularly revoke unnecessary permissions and check activity records, as agents may behave inconsistently even when performing similar tasks.

Third, users should understand how their information is used and stored.

Information shared directly or obtained through connected accounts may be processed and stored by the agent provider and its partners. Users should check what is collected, who receives it, how long it is retained and what happens after an account is disconnected.

They should also check whether their information is used to train AI models or personalise advertisements and adjust available settings.

“Many personal AI agents have persistent memory, and they can create personal profiles of you and your contacts based on your files and interactions,” the advisory said.

Users should delete stored information that is inaccurate or that they do not want retained or used.

The fourth step is to guard against scammers and malicious actors, who may target agents through instructions hidden in websites, e-mails, calendar invitations, documents or images.

These could manipulate agents into making purchases, transferring funds or revealing personal data without the user’s request.

“The best protection is to limit what your agent can see or do,” the advisory said.

Users should monitor agents as they browse on their behalf, restrict who can give them instructions, use strong authentication, download agents only from official sources and use only trusted third-party add-ons.

If something goes wrong, they should stop the agent, disconnect affected accounts and look out for changes they did not make, such as payments, changed settings or e-mail forwarding rules. They should save activity records before deleting suspicious memories, add-ons or tasks, and notify anyone affected.

Finally, users should consider others whose information an agent may encounter.

E-mails, messages and files can contain details about family, friends and colleagues. Users should consider whether those people would be comfortable with an agent reading or sharing them, and delete unnecessary memories about others.

They should indicate when an e-mail or message was sent by an AI agent, and not ask it to bypass paywalls, login requirements or other access restrictions.

“Respect other people’s information,” the advisory said. “Avoid sharing sensitive information about others unless you need to.”