Singapore authorities warn of privacy, security risks from personal AI agents

Singapore authorities have cautioned consumers about potential privacy and security risks associated with personal AI agents. These intelligent assistants, capable of managing tasks like emails and bookings, may inadvertently grant scammers unauthorized access to sensitive information. Unlike conventional AI chatbots, personal AI agents can perform actions on behalf of users, exposing them to potential privacy breaches and manipulation.

The Cyber Security Agency, GovTech, and Infocomm Media Development Authority (IMDA) issued an advisory on November 6, highlighting the risks posed by AI agents such as Dots, Hermes, Muse, Grok Bot, and OpenClaw. These agents may continue operating even when users are not actively using them, and could be tricked by malicious actors into carrying out harmful actions.

Consumers are advised to limit the permissions granted to AI agents, retain control over important actions, and understand how to revoke access. They should connect only necessary apps and accounts, avoid sharing sensitive credentials, and refrain from granting access to banking, government, or healthcare services. When using services like Singpass, consumers should opt for passkey authentication and avoid approving unexpected requests.

Some AI agents may perform actions on users' behalf, requiring limited or read-only permissions to mitigate risks. Users should monitor agents' activities, review permissions regularly, and revoke any unnecessary access. They should also be cautious of scammers targeting AI agents directly through fraudulent instructions in messages, emails, or other digital communications.