Singapore authorities are warning consumers to think carefully before giving personal artificial intelligence agents access to their emails, online accounts and sensitive information, as increasingly powerful AI tools raise new concerns about privacy, cybersecurity and financial scams.
The warning follows a joint advisory issued on November 6, 2026, by the Infocomm Media Development Authority (IMDA), Cyber Security Agency of Singapore (CSA) and Government Technology Agency of Singapore (GovTech). Published by AsiaOne on November 10, the advisory outlines five essential precautions for people using personal AI agents that can perform tasks on their behalf.
Unlike conventional AI chatbots that primarily answer questions or generate information, personal AI agents can interact with websites, applications and online accounts. Depending on the permissions granted, they can manage emails, organise schedules, make bookings, purchase products and carry out other digital tasks with limited human supervision.
Examples include Dots, Hermes, Muse, Grok Bot and OpenClaw.
While these tools promise greater convenience and productivity, authorities warn that granting them broad access could expose personal information, enable unauthorised transactions or allow malicious instructions to manipulate their behaviour.
The central message is clear: an AI agent may act on a user’s behalf, but users remain responsible for how they deploy it and the actions it takes.
1. Do Not Give AI Agents Unrestricted Access to Your Accounts
The first recommendation is to limit the information and applications an AI agent can access.
Authorities advised consumers to connect only the accounts necessary for a specific task. Users can begin with less sensitive services, such as a secondary email account, rather than immediately connecting their primary personal or work accounts.
They were specifically warned against granting AI agents access to sensitive services involving banking, government transactions and healthcare.
Users should also avoid sharing passwords, passcodes, one-time passwords (OTPs) and credit card details with these systems.
For services using Singpass, the authorities recommend using passkey authentication where available and completing the authentication process personally. Users should never approve unexpected authentication requests simply because an AI agent asks them to do so.
The concern is particularly serious when an agent can access an email inbox containing authentication messages. If compromised or manipulated, it could potentially expose information that helps someone gain access to other accounts.
The Straits Times also highlighted the importance of checking with employers before connecting workplace accounts, as business emails and shared files may contain confidential company information. The Straits Times+1
2. Keep Human Approval for Important Transactions
Personal AI agents can potentially send messages, purchase products, delete files and publish content online.
That ability creates a significant risk when an agent misunderstands instructions or is manipulated into taking an action its user never intended.
IMDA, CSA and GovTech recommend starting with limited or read-only permissions wherever possible.
Users should require explicit approval before allowing agents to perform consequential activities, including:
- Sending messages or emails.
- Making purchases or financial transactions.
- Deleting or sharing files.
- Publishing content publicly.
- Changing important account settings.
The advisory also recommends choosing one-time approval rather than allowing an agent to perform similar actions through an unrestricted “always allow” permission.
Importantly, users should not rely entirely on conversational instructions to control an agent. Authorities say permissions should be managed through the relevant application settings because instructions given through chat may not always be followed consistently.
Regularly checking activity histories and removing unnecessary permissions can also help prevent unwanted actions.
3. Understand Where Your Personal Information Goes
Another major concern involves the collection, storage and use of personal information.
When an AI agent connects to email accounts, calendars, messaging services and other applications, it may process information beyond what users directly type into its chat interface.
That information could include private conversations, contact details, appointments, documents and personal records.
Authorities advised consumers to understand:
- What information the AI agent collects.
- Which companies or service providers receive the information.
- How long the information is retained.
- Whether conversations and connected-account data are used to train AI models.
- Whether personal information is used for advertising or personalisation.
Users should also review their agents’ persistent memory, which may contain information gathered from previous conversations and connected files.
Inaccurate or unnecessary information should be removed where possible.
The warning is especially relevant for people who use the same AI assistant for personal, professional and financial activities. Connecting multiple accounts can make an agent more useful, but it can also increase the amount of sensitive information exposed if something goes wrong.
4. Scammers Could Manipulate AI Agents Without Directly Tricking Their Owners
Perhaps the most concerning part of the advisory involves a form of cyberattack that targets the AI agent itself.
Authorities warned that malicious instructions could be hidden inside websites, emails, calendar invitations, messages, documents and images.
An AI agent processing this content could potentially be manipulated into performing actions outside the user’s original instructions.
These attacks can involve attempts to make an agent reveal private information, purchase products, transfer money or interact with unauthorised websites.
The danger becomes more complicated when agents continue operating in the background. Users may not immediately notice that an agent has encountered malicious content or performed an unexpected action.
Consumers are therefore advised to monitor agents when they browse websites, restrict who can issue instructions and obtain AI tools and third-party add-ons only from trusted sources.
If an agent behaves unexpectedly, users should stop its activity and disconnect affected accounts. They should then check for unauthorised transactions, unfamiliar devices, changed account settings and other suspicious activity.
People who suspect a scam can contact Singapore’s 24-hour ScamShield Helpline at 1799. Those with compromised Singpass accounts can contact the Singpass Helpdesk at 6335 3533.
Cybersecurity incidents involving compromised devices or accounts can also be reported to CSA’s SingCERT through its Cyber Aid reporting channel. CNA+1
5. AI Agents Could Expose Other People’s Private Information Too
The final recommendation focuses on a risk that users may easily overlook: personal AI agents can encounter information belonging to other people.
Emails, messages, shared documents and contact lists may contain private details about family members, colleagues, friends and business partners.
When an agent receives access to these materials, it may process information about people who never directly agreed to interact with that AI system.
Authorities advised users to consider whether other people would be comfortable with their information being accessed or shared.
Consumers should remove unnecessary information from their agents’ stored memories and indicate when messages or emails have been prepared or sent by an AI agent.
They were also warned against instructing AI agents to bypass website restrictions, including paywalls and login requirements.
The guidance highlights an important point: using an AI assistant does not remove a person’s responsibility to respect privacy, confidentiality and access restrictions.
Singapore’s Warning Comes as AI Agents Become More Powerful
The latest advisory reflects growing concern about the shift from conversational AI to systems capable of independently carrying out digital tasks.
The distinction is significant.
A traditional chatbot might explain how to book a hotel. An AI agent could potentially search for accommodation, compare prices, enter booking information and complete a reservation if it has been granted the necessary permissions.
That convenience also creates more opportunities for mistakes, manipulation and unauthorised access.
In May 2026, IMDA separately warned users and organisations about the security risks of OpenClaw, an open-source AI assistant capable of interacting with applications and digital services.
The Straits Times and CNA reported that authorities cautioned against giving OpenClaw unrestricted access to sensitive files and applications or deploying it in mission-critical environments without appropriate safeguards.
The concerns included inadequate security controls, access-control weaknesses and the possibility of sensitive information being exposed. The Straits Times+1
These earlier warnings show that Singapore’s latest consumer advisory is part of a wider effort to address the risks created by increasingly autonomous AI systems.
WWC ONE MEDIA previously examined the same emerging threat in its report, INTERPOL Warns Agentic AI Could Automate Cyberattacks as Criminals Scale Scams at Machine Speed.
As AI tools become capable of performing more complicated tasks, criminals may also find new ways to exploit them.
Who Is Responsible When an AI Agent Makes a Costly Mistake?
One of the most important points in Singapore’s advisory concerns accountability.
Authorities stressed that users remain responsible for how they use personal AI agents, including actions performed on their behalf. Depending on the circumstances and applicable laws, users may also be held liable.
This does not mean every mistake automatically makes the user legally responsible. The circumstances, permissions granted, conduct of the parties involved and relevant legal obligations will all matter.
However, consumers should not assume that an AI agent can take responsibility for an unauthorised transaction or the disclosure of private information.
The question of accountability is also becoming a major policy issue in Singapore.
WWC ONE MEDIA previously reported on the country’s discussion about establishing a system to identify AI agents and verify their authorised responsibilities in Singapore Weighs National Identity Registry for AI Agents — Jasmin Lau Raises the Big Question: Who Is Accountable When AI Acts for You?.
The broader issue is whether organisations and individuals can reliably establish who authorised an AI agent, what it was allowed to do and who should answer when something goes wrong.
Singapore’s AI Security Concerns Extend Beyond Personal Assistants
The warning also comes amid a wider push to strengthen digital security as more services rely on connected accounts and online authentication.
AI agents may introduce additional risks because they can interact with multiple applications using the permissions granted by their owners.
WWC ONE MEDIA has previously covered Singapore’s efforts to strengthen identity protection in Fraud Risks Push Singapore to Tighten Identity Checks Across Digital Services as Scams Grow More Sophisticated.
The publication has also examined concerns surrounding autonomous systems in Rogue AI Hacking Raises Red Flags as Cyber Defences Struggle to Keep Pace.
These developments underline why cybersecurity specialists and regulators are increasingly focused on permission controls, monitoring, authentication and human oversight.
The challenge is not necessarily to stop people from using AI agents. It is to make sure that the technology cannot access or change more than its owner intended.
What Users Should Do Before Connecting an AI Agent
For consumers who already use personal AI agents, the latest advisory provides a practical checklist.
Before connecting an account, users should ask whether the agent genuinely needs access to it. They should avoid connecting banking, healthcare and government accounts, never provide authentication credentials, and require personal approval for purchases, payments and other consequential actions.
They should also regularly review connected applications, check stored memories and monitor activity records.
If an agent suddenly behaves unexpectedly, users should stop it, disconnect affected accounts, review suspicious activity and change compromised passwords. If money may be at risk, they should contact their bank immediately through its official channels.
The safest approach is to give AI agents only the minimum access necessary to complete a task.
Singapore’s message is not that personal AI assistants should never be used. Rather, convenience should not come at the expense of privacy, financial security and personal control.
As these systems become more capable of acting independently, the consequences of granting them unrestricted access could become increasingly serious.
