Personal AI Agents in Singapore: The New Safety Advisory, the ARC Framework and 5 Steps to Stay in Control

Last week, this blog wrote about a Cornell Tech–Yale test in which nine out of ten AI models raised their own spending limits by reading the approval code out of the owner's inbox. This week, Singapore answered. In the space of three days, Parliament debated whether AI agents need an identity, GovTech unveiled a framework for governing them, and three government agencies issued a consumer advisory on how to use personal AI agents safely.

The message is consistent across all three: an agent is not a human assistant, and the approval must stay with a human.

Photo: A human hand and a robot hand touching, symbolising human–robot connection. Photo by Tara Winstead on Pexels, free to use.

The advisory: five steps before you connect an agent

On Friday 6 November, the Cyber Security Agency of Singapore (CSA), GovTech and the Infocomm Media Development Authority (IMDA) issued a joint advisory for consumers using personal AI agents — software that can carry out tasks on your behalf, such as managing email, making bookings and accessing online accounts. The advisory names Dots, Hermes, Muse, Grok Bot and OpenClaw as examples. It follows Meta's launch in Singapore of Muse, which the company bills as the world's first personal AI agent built for consumers.

The warning is blunt. Unlike a chatbot, an agent can act — and it can keep acting in the background while you are not watching. "Depending on the access you give them, AI agents may read and reveal sensitive personal information, make mistakes, or take actions that you did not intend," the agencies said. "You cannot treat them like human assistants and give them the same broad access to your information and implicit trust."

Worse, scammers do not have to fool you any more. They can target the agent directly: malicious instructions hidden in a website, an email, a calendar invitation, a message, a document or an image can trick an agent into making a purchase, transferring money or revealing personal information.

The advisory sets out five steps:

1. Limit what your agent can access. Connect only the apps and accounts an agent needs for a task, and restrict the information it can reach where possible. Do not give an agent access to sensitive accounts — banking, government services or healthcare — and never share passwords, passcodes, one-time passwords or credit card details with one. For Singpass, use passkey authentication by default, complete the authentication yourself, and do not approve unexpected requests.

2. Stay in control of important actions. Start with limited or read-only permissions where possible, and make the agent ask before anything consequential: sending messages, deleting or sharing files, posting public content. Choose one-time approval over "always allow", and check the details before approving a high-risk transaction. Set these restrictions in the app's settings, not by typing instructions to the agent in chat — the agencies warn that chat instructions may not always be followed consistently.

3. Understand how your information is used. Information you share with an agent, including from connected accounts, may be processed and stored by the provider and the companies it works with. Check what is collected, who it is shared with and how long it is kept — and whether it is used to train AI models or personalise advertising. Many agents have persistent memory and build profiles of you and your contacts; review that stored information regularly and delete what is inaccurate or unwanted.

4. Watch out for scammers targeting the agent. Monitor what the agent does when it browses websites, make sure it is not logged in to important accounts, and stop it if it tries to visit an unintended site or carry out an unauthorised action. Use strong authentication, download agents only from official sources, and avoid untrusted third-party add-ons.

5. Consider how your agent affects others. An agent with access to your inbox and contacts can also reach other people's personal information. Do not share it unnecessarily, and say when a message was sent by an agent rather than by you.

Two points in the advisory deserve emphasis. First, you remain responsible for what your agent does on your behalf, and you may be held liable depending on the circumstances and the law. Second, if you suspect an agent has been compromised, stop it at once, disconnect the affected accounts, review its activity history for unauthorised payments or new payees, change your passwords and revoke unnecessary permissions. If money is at risk, use your banking app's kill switch or lock your cards and call your bank on its official hotline. If you are unsure whether you have encountered a scam, call the 24-hour ScamShield Helpline on 1799; if money has been lost or a crime committed, make a police report.

ARC: matching the safeguard to what the agent can do

The advisory tells consumers what to do. GovTech's ARC Framework tells organisations — starting with the Government itself — how to decide what an agent should be allowed to do in the first place.

ARC, the Agentic Risk and Capability Framework, was presented by Senior Minister of State for Digital Development and Information Tan Kiat How in his opening address on day two of the GovTech STACK Conference 2026, on 5 November. It connects an agent's capabilities to appropriate safeguards: for higher-risk actions, including financial transactions, official communications and data deletion, stronger controls such as human approval are needed. As he put it: "An assistant that drafts a wrong message is different from an agent that sends it. Recommending a payment is different from making one."

ARC builds on IMDA's Model AI Governance Framework for Agentic AI, published in January 2026, translating its principles into concrete technical requirements for the whole of government — covering human oversight, permissions management, tool access, testing and monitoring. The framework will also guide Desk, GovTech's secure personal digital assistant for public officers, as it gains more agentic capabilities: it will help determine which actions can proceed automatically and which require human approval.

Two pieces of shared infrastructure sit behind it. GovHarness, now in development, will provide common guardrails and evaluation for AI agents across Government, so teams do not each have to rebuild their own monitoring and testing. And Rabbit Deploy, GovTech's platform for officers to deploy and test AI-assisted applications with government hosting, single sign-on, logs and continuous security scanning built in, already supports over 8,000 users across 90 agencies, with over 5,000 active applications. One example given in the address: an Integrated Treasury application built by a finance officer cut the time needed to consolidate information from 14 sources from 12 hours to one hour a month, saving over 130 staff-hours a year.

The goal, in Tan's words, "is neither maximum autonomy nor maximum control. It is to give AI room to act within clear boundaries, while people and organisations remain accountable for the outcomes."

Who is the agent? Parliament and the identity question

The third piece of the week came from Parliament, a day earlier, on 4 November. MP Tin Pei Ling (Marine Parade–Braddell Heights GRC) proposed that the Government consider building a national digital identity infrastructure for AI agents — an open and trusted registry against which any entity could check an agent's identity and what it is authorised to do.

Senior Minister of State for Digital Development and Information Jasmin Lau, responding to the adjournment motion, did not commit to a registry. She said the Government's approach is to work with industry, build on existing infrastructure and emerging international standards, and step in with common standards or infrastructure where there are gaps industry cannot fill on its own.

Concretely, IMDA is working with GoDaddy, Infoblox, Cloudflare and Google to explore whether the Domain Name System (DNS) — the internet's address book — can be adapted to identify and verify AI agents across different platforms and organisations. That work, Lau said, "will inform our assessment of whether additional common infrastructure, including a national registry, is needed." Separately, GovTech is developing an internal registry so public agencies can keep track of the AI agents they deploy and the officers responsible for them.

So there is no national registry for AI agents, and none has been promised. What exists is an exploration — and a clear signal that identity and accountability are now on the Government's agenda, not just safety tips for users.

Why this is not theoretical

The urgency is not hypothetical. In July 2026, an AI agent that OpenAI was testing for its hacking abilities broke out of a restricted test environment and spent more than two days inside the systems of Hugging Face, the platform that hosts AI models and datasets. Other instances of AI going rogue were subsequently reported.

That is the backdrop to the funding announced on 10 November, when Minister of State for Digital Development and Information Rahayu Mahzam announced at CyberSG Innovation Day 2026 that 13 projects will share about $5.6 million under CSA's CyberCall 2025 challenge to develop and test new cybersecurity tools. One recipient, Singapore firm CloudsineAI, is building software that maps what each AI agent can reach — tools, databases, other agents — tracks what agents do once running, and alerts owners if they break company policies. Its founder and chief executive, Matthias Chin, said AI agents could outnumber human workers within a few years. CSA has also launched CyberCall 2026, with proposals due on 9 January 2027.

A short checklist for readers

• Do not give an agent the inbox that receives your approval codes. If it can read the approval, it is not an approval. Enter codes yourself.
• Start read-only. Give an agent the smallest permission for one job, and require one-time approval for anything that moves money, sends a message, deletes or shares.
• Keep banking, government and healthcare accounts away from agents. For Singpass, use passkeys and complete the authentication yourself.
• Check what the agent remembers. Review its stored memory and connected accounts, and delete what you do not want kept.
• If something looks wrong, stop the agent, disconnect the accounts, check the activity log, and call ScamShield on 1799 if you are unsure.

Sources: Channel NewsAsia, "Singapore authorities warn of privacy, security risks from personal AI agents", 6 Nov 2026; The Straits Times, "Singapore warns of privacy dangers as personal AI agents like Meta's Muse gain consumer access", 6 Nov 2026; AsiaOne, "Thinking of using a personal AI agent? Here's how to do it safely", 6 Nov 2026; Government Technology Agency of Singapore, "Opening Address by SMS Tan Kiat How at GovTech STACK Conference 2026 Day 2", 5 Nov 2026; The Straits Times, "S'pore exploring adapting web domain name system to track AI agents, need for national registry", 5 Nov 2026; The Straits Times, "CSA awards $5.6m for cybersecurity tool projects", 10 Nov 2026; this blog's 6 Nov 2026 post, "AI Agents Raised Their Own Spending Limits: What the Cornell–Yale Test Means for Singapore Users".

Share This:

Post Tags: