Singapore’s Cyber Security Agency, GovTech and Infocomm Media Development Authority have issued joint advice on using personal AI agents safely, urging consumers to limit account access and retain control over consequential actions. The 6 November advisory notice introduces a four-part consumer guide covering permissions, approvals, data use and scams. It is guidance, not a new regulation or licensing scheme.
The agencies’ concern is the access an agent receives when it can operate apps and services for a user. The guide names Dots, Hermes, Muse, Grok Bot and OpenClaw as examples of personal agents; naming them is not an endorsement or a blacklist. CSA also announced the joint advisory on its official X account, identifying GovTech and IMDA as its partners.
Personal AI agents should receive only the access they need
The first step is to limit access. The agencies advise connecting only necessary apps and avoiding access to sensitive accounts such as banking, government and healthcare services. They caution against disclosing passwords or one-time passwords and against sharing payment-card details with an agent.
For Singpass, the guide points to passkeys and says the user should complete authentication personally. This places the authentication decision with the account holder rather than treating a conversation with an agent as a substitute for it.
The second step is to stay in control. The guide recommends starting with read-only access, preferring one-time approval to an always-allow setting and using an application’s settings to constrain actions. Its reason for distinguishing settings from chat instructions is that the latter may not be followed consistently.
That is a distinction between an enforceable permission or approval mechanism and a request written into a conversation. The advisory is not promising that any particular agent product implements every safeguard in the same way.
Data settings and hidden instructions are separate risks
The third step concerns how providers use data. The agencies encourage users to inspect settings relating to model training and advertising and to understand persistent memory profiles. Information retained for future interactions is a different consideration from permission to perform a single action, so an approval decision alone does not answer the data-use question.
The fourth step addresses scams and untrusted material. The guide warns that hidden instructions can appear in webpages, email, calendar invitations, documents or images encountered by an agent. This is the prompt-injection concern: material the agent is supposed to read may instead attempt to redirect its behaviour.
The agencies also advise obtaining agents from official sources and using trusted add-ons. Their warning is about the provenance of software and instructions, rather than an allegation that every third-party extension is malicious. The guide states that users remain responsible for how they use agents, including actions taken on their behalf; this is part of the advisory’s accountability message, not a newly enacted liability rule described in these sources.
An approval gate is different from a reassuring chat reply
The practical value of the four steps is that they separate decisions often bundled together when someone first connects an agent. Account access determines what it can reach; an approval setting determines when it can act; data settings concern how information may persist or be used; and prompt-injection precautions concern whose instructions it follows when reading outside content. A reassuring answer in the chat cannot resolve all four at once.
The contrast between one-time and standing approval is particularly important. A user may intend to authorise one task without authorising a continuing class of actions. The agencies’ preference for one-time approval preserves a decision point, while their emphasis on application settings recognises that a conversational instruction may be a weaker boundary. This does not establish that every approval mechanism is flawless; it explains why permission design matters independently of an agent’s ability to understand a request.
Nor should the list of example products be read as a government quality ranking. The guidance applies across a category of consumer tools and directs attention to the access and settings a person actually grants. Its significance is that account holders need visible control points, rather than relying only on the agent’s assurances about what it intends to do.
The distinction connects with Microsoft’s work on guardian agents and insider risk. Claude Duet’s stated boundary against moving money shows a product-specific restriction, while Grok Bot’s vault for account and contact details addresses stored information. These are related product approaches, not evidence that the Singapore agencies approved them.
The consumer question left by the advisory is concrete: which permissions, approvals and data settings does a particular agent actually expose? The agencies’ answer is to examine those controls before allowing the tool to act.
Sources
- CSA/GovTech/IMDA joint advisory AD-2026-015, 6 November 2026; PDF linked on page
- CSA official X announcement, 6 November 2026
Related stories
Microsoft Says AI Agents Are Insider Risks, Adds Guardian Agents takes the same access-and-oversight question from consumer settings into enterprise controls.
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
