What should people do before giving an AI agent account access? Singapore set out five safety steps
Singapore's cyber, digital-government and media regulators advise narrow permissions, human approval for consequential actions, activity-log checks, rapid revocation and disclosure when an agent communicates for someone.
The short version
- What happened
- Singapore's CSA, GovTech and IMDA jointly advise consumers to grant only the access an agent needs and to avoid connecting banking, government or healthcare accounts.
- Who it affects
- Consumers can reduce the damage from a mistaken or manipulated agent by limiting connected accounts and retaining approval over messages, purchases, public posts and deletion.
- What remains unproven
- Official preventive guidance, not an empirical study, incident report, product comparison or independent security assessment.
Keep in mind
Official preventive guidance, not an empirical study, incident report, product comparison or independent security assessment.
The Muse walkthrough reflects settings available in Singapore on 5 November 2026 and may change or differ by platform and region.
The advisory does not measure how often controls fail, how users understand them or whether activity logs are complete.
Legal responsibility varies by conduct and jurisdiction; the document does not determine liability for a particular agent action.
Source analysis · 2 linked sources. Primary analysed source date: 6 November 2026.
Read the full report · 8 min The evidence, methods, implications and limitations
The direct answer: start with the smallest permission and a way back out
People should not give a personal AI agent the broad trust they might give a human assistant. That is the central message of an eight-page advisory issued jointly by Singapore's Cyber Security Agency, Government Technology Agency and Infocomm Media Development Authority. The agencies recommend connecting only the accounts required for a task, beginning with low-risk material, keeping approval over consequential actions, checking what the provider stores and knowing how to pause, disconnect and revoke access before anything goes wrong.
The advice responds to a practical difference between chatbots and agents. A chatbot usually answers inside one conversation; an agent may browse websites, read email, manage a calendar, send messages, make bookings, retain preferences and continue a task in the background. Those capabilities can save time, but they also enlarge the damage from a mistaken instruction, excessive permission, compromised account or malicious content. The advisory is guidance rather than a finding that any named product has suffered a successful attack.[1][2]
Step one is about reach, not how helpful the agent appears
The first step is to limit what the agent can see. The agencies advise users to connect only necessary apps and accounts and, where a service permits it, restrict the agent to particular folders or information. They suggest trying a secondary email account or other low-sensitivity content before connecting an everyday account. Banking, government and healthcare accounts are singled out as services that should not be connected casually; workers should also check whether an employer allows an agent to access work systems.
Credentials require a separate boundary. The document says not to disclose usernames, passwords, passcodes, one-time passwords or documents that contain them. If an agent can read the inbox receiving an authentication code, it may effectively see that code too. The Singapore-specific advice is to complete Singpass authentication personally, prefer passkeys and avoid approving unexpected requests. A more general lesson travels beyond Singapore: separating the agent from the channel used for authentication reduces the chance that one permission silently defeats another control.[1]
The distinction that matters
Five controls before an agent acts for you
Singapore's advisory turns a broad warning into five practical control areas.
1. Access
Connect only what is needed
Keep sensitive accounts separate
2. Actions
Require one-time approval
Prefer settings over chat promises
3. Data
Check storage, sharing and training
Review persistent memory
4. Attacks
Watch browsing and activity logs
Stop and revoke on suspicion
5. Others
Protect contacts' information
Disclose agent-sent messages
Approval must live in the product controls, not only in a prompt
The second step is to retain control of important actions. The advisory recommends read-only access where possible and one-time approval before sending a message, deleting or sharing a file, posting publicly or completing another high-impact action. It explicitly warns against relying only on a conversational instruction such as 'always ask me first'. An agent may not follow natural-language limits consistently, while operating-system, account and connector settings can impose a more concrete boundary.
Activity monitoring is part of the same control. Users are told to review permissions and credentials regularly, remove those no longer needed and compare the agent's claimed actions with its activity history. This matters for scheduled or background tasks: the visible chat may not be a complete record of what an agent did, what it plans to do or which standing approval it reused. The guidance does not establish that every provider supplies a complete, tamper-resistant log, so consumers still need to inspect what the particular service exposes.[1]
Data use extends beyond the conversation window
Step three asks users to find out what data is collected, which companies receive it, how long it is retained and what happens after an account is disconnected. The agencies also recommend checking whether conversations or connected-account information may be used for model training or advertising. Persistent memory can build a profile from messages, files and contacts; deleting an integration does not necessarily erase information already copied into the agent's memory or processed by another provider.
The warning also covers other people's data. An inbox or shared drive contains information about colleagues, patients, friends and family who did not choose to connect an agent. The advisory asks users to consider whether those people would be comfortable with their information being read or stored, remove unnecessary material and indicate when an external message was sent by an AI agent. That disclosure is a recommended practice in this guide, not proof of a universal legal requirement in every jurisdiction.[1]
Prompt injection is presented as an account-security problem
Step four describes how an agent can be manipulated by instructions hidden in a webpage, email, calendar invitation, message, document or image. A successful instruction could cause a purchase, transfer, disclosure or another action the user never requested. The recommended defences are deliberately basic: restrict who can instruct the agent, avoid untrusted group chats and add-ons, use strong authentication, watch browsing behaviour and stop the task if it moves to an unintended site or account.
If behaviour becomes suspicious, the guide tells users to stop or pause the agent, disconnect affected accounts in both the agent and the underlying service, change passwords, sign out of sessions and inspect messages, payments, forwarding rules, payees, devices and recovery details. It also recommends preserving activity records before resetting or deleting the agent. Resetting may remove local history without reversing an email already sent, a payment already initiated or information already disclosed, so recovery must include the affected services themselves.[1]
The product example is an illustration, not a security rating
An annex maps the five steps to Meta's Muse controls as they appeared in Singapore on 5 November 2026. It covers connectors, web-access approvals, activity logs, upcoming tasks, model-training settings, memory files, two-factor authentication, data download and reset. The agencies say explicitly that menus may change, the example is not exhaustive and its inclusion is neither an endorsement nor an assessment of Muse's security or privacy.
That qualification is important because a settings walkthrough can be mistaken for independent testing. The advisory does not test whether a control can be bypassed, whether an activity log is complete, how frequently agents misbehave or how often users notice an unsafe request. Nor does it compare Dots, Hermes, Muse, Grok Bot and OpenClaw despite naming them as examples. The document's value is a concrete consumer checklist; assurance about a product still requires technical evaluation, incident reporting and provider accountability.[1]
What would strengthen the guidance
The guide places responsibility on users to configure, monitor and recover from agent actions, while noting that legal responsibility depends on the circumstances and applicable law. Future evidence should test whether ordinary users can find the controls, understand approval scope, detect hidden instructions and revoke access quickly. Providers could publish permission schemas, retention behaviour, log coverage, incident rates and independent red-team results in forms consumers and regulators can compare.
For organisations, the practical next step is to define which accounts agents may access, require human confirmation for high-impact actions, preserve auditable records and rehearse revocation. For individuals, the safest trial is a narrow task with non-sensitive data and no authority to spend, publish or delete. The advisory does not say personal agents are unusable; it says capability should be matched by constrained authority and a tested recovery path.[1][2]
Keep following the evidence
Join The Impact Brief founding list for selected AI reports, their effect on people and the evidence limits. Read a sample first.
Continue the story
Read next
Continue exploring prompt injection: compare the finding and its evidence limits.
Can encoded instructions turn AI-agent skills into security exploits?
Yes, in a controlled benchmark: some models decoded and followed malicious payloads hidden in third-party skill files. Attack rates fell sharply with the original longer files, and the work does not demonstrate a live breach.
Read the next reportExplore the full source and evidence record
What this means for people
- Consumers can reduce the damage from a mistaken or manipulated agent by limiting connected accounts and retaining approval over messages, purchases, public posts and deletion.
- Workers may expose employer or client data if a personal agent is connected to work email or files without permission.
- Contacts can have their messages, files and personal details processed even though they never chose to use the agent, making data minimisation a shared privacy issue.
Global context
Singapore's advice is locally grounded—Singpass, ScamShield and Singapore reporting channels are included—but the architecture of the risk is global. Agents increasingly cross email, calendars, browsers, cloud files and social services whose providers and data centres may sit in other jurisdictions. Authentication, privacy, consumer-protection and employment rules differ, yet the least-privilege principle, human approval for consequential actions and service-level revocation remain broadly applicable.
What the evidence does not yet show
- Official preventive guidance, not an empirical study, incident report, product comparison or independent security assessment.
- The Muse walkthrough reflects settings available in Singapore on 5 November 2026 and may change or differ by platform and region.
- The advisory does not measure how often controls fail, how users understand them or whether activity logs are complete.
- Legal responsibility varies by conduct and jurisdiction; the document does not determine liability for a particular agent action.
What to watch next
- Independent usability tests of permission, monitoring and revocation controls.
- Provider disclosures about activity-log coverage, retention and prompt-injection incidents.
- Whether regulators define minimum approval and audit requirements for consumer agents.
- Cross-border rules for liability when an agent acts through several services.
- Changes to the product settings described in the 5 November Muse illustration.
Living evidence record
Impact record IAI-0EI34QW
Evidence stage
Announced
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Not yet
Record status
Monitoring
Last checked
6 November 2026
Source trail
2 direct sources across 2 source types.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Related-source reporting disclosure
This record analyses 2 linked source records around the same underlying development. The extra records add method, date or context, but they do not by themselves constitute independent replication of every performance claim or predicted outcome.
Evidence trail
Sources used for this report
Links checked 6 November 2026
Research question, topics and regions
How consumers can limit privacy, fraud and account-security risks when personal AI agents can browse, remember information and act across connected services
Topics: Personal AI agents · Cybersecurity · Privacy · Account access · Prompt injection · Consumer protection
Regions: Singapore · Asia & Middle East · Global
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.