Singapore authorities warn of privacy, security risks from personal AI agents

“AI agents can be very useful, but you cannot treat them like human assistants and give them the same broad access to your information and implicit trust,” the authorities warned.

Instead, users should limit the permissions they grant, retain control over important actions and understand how to revoke access.

The authorities also cautioned that users remain responsible for how they use AI agents, including actions taken on their behalf, and may be held liable depending on the circumstances and applicable laws.

LIMIT ACCESS TO SENSITIVE ACCOUNTS

Personal AI agents may request access to users’ emails, calendars, contacts, messages, files and other online accounts.

Once connected, they may be able to retrieve, process and share information from these services, including personal information belonging to others, the authorities warned.

Users should therefore connect only the apps and accounts necessary for an agent to perform its tasks, and restrict the information it can access where possible.

They should also avoid granting agents access to sensitive accounts, such as those used for banking, government or healthcare services, and refrain from sharing credit card details.

The authorities advised users not to disclose usernames, passwords, passcodes, one-time passwords (OTPs) or other authentication credentials to AI agents.

For services that use Singpass, consumers should opt for passkey authentication by default, complete the authentication process themselves and avoid approving unexpected requests.

They should also choose authentication methods that require human action when using other digital services.